CVE-2026-75028

🎯 CVE-2026-75028 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-75028 | The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls,

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

Klassifikation & Betroffenheit:

CWE-98 arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System 0 ≤3.0.18

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 🎯 High

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

🛡️ Empfohlene Mitigation: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-193 · PHP Remote File Inclusion (High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2025-24937 9.0 CVE-2026-96837 8.8 CVE-2025-68047 8.8 CVE-2025-67915 8.8 CVE-2025-68645 8.8

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 10/2026

Heute 23.10.

CVSS-Vektor-Analyse: 7.5

AV · Angriffsvektor Netzwerk

AC · Komplexität Hoch

PR · Privilegien Gering

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CNA-Bewertung (Wordfence): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Veröffentlicht:03.10.2026

Aktualisiert:06.10.2026 15:04

Assigner (CNA):Wordfence

EUVD-ID:EUVD-2026-91955

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-98 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	725	0,2 %
≥50 %	3.222	0,9 %
≥10 %	22.088	5,9 %
<10 %	347.137	93,0 %

7.5 HIGH

EPSS

0.7%

CVE-2026-75028 🌐 Netzwerk (Remote) 🔑 Geringe Nutzerrechte nötig

arraytics

CVE-2026-75028 | The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls,

CWE-98 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 20 Tagen ↻ vor 20 Tagen

🛡️ Details ➔

Noch keine Analyse zu CVE-2026-75028

Beitrag zu CVE-2026-75028 verfassen

Zero-Day & Vulnerability Intelligence Hub