CVE-2026-75028: WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Contributor-level permissions. Unauthenticated visitors are not described as able to exploit it.
What does successful exploitation require?
The attacker must be able to influence the food_menu_style Elementor widget setting so that the vulnerable template-loading function includes a chosen local PHP file. The described impact is greatest where PHP files can be uploaded and then included.
Are default installations affected?
The affected versions are all WPCafe releases through 3.0.18, but the provided information does not establish whether the vulnerable Elementor widget configuration is present or reachable in a default WordPress installation.
What can be done if updating is not immediately possible?
Restrict or remove Contributor-level and higher accounts that are not trusted, especially accounts able to edit Elementor content. Preventing PHP uploads and reviewing existing uploaded PHP files can reduce the paths described for code execution.
How can administrators assess exposure?
Check whether WPCafe version 3.0.18 or an earlier version is installed and whether Contributor-or-higher users can edit content containing the food_menu_style Elementor widget. Review for unexpected PHP files on the server and for suspicious widget settings that may reference local template paths.