CVE-2026-73400: WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability

Q: Which deployments are exposed to this issue?

Sites running Restaurant Menu by MotoPress version 2.4.11 or earlier are affected according to the available data. Exploitation does not require authentication or user interaction and can be attempted over the network.

Q: What access does an attacker need to exploit it?

An attacker needs network access to the affected site and must overcome high attack complexity. No WordPress account or other privileges are required.

Q: What can be done while a patch is unavailable?

The provided data identifies affected versions through 2.4.11 but does not provide a fixed version or workaround. If patching cannot be performed immediately, assess whether the plugin is installed and reduce untrusted network access to the affected site where operationally feasible.

Published Aug 18, 2026

Updated

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.

Affected Software

1 affected component

MotoPress Restaurant Menu by MotoPress<=2.4.11

Event History

Aug 18, 2026

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Sites running Restaurant Menu by MotoPress version 2.4.11 or earlier are affected according to the available data. Exploitation does not require authentication or user interaction and can be attempted over the network.

What access does an attacker need to exploit it?

An attacker needs network access to the affected site and must overcome high attack complexity. No WordPress account or other privileges are required.

What can be done while a patch is unavailable?