CVE-2024-37513: WordPress WPCafe plugin <= 2.2.27 - Local File Inclusion vulnerability

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-09 · updated 2026-06-17
Weakness: CWE-22

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows Path Traversal.This issue affects WPCafe: from n/a through 2.2.27.

Affected products

arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System: before 2.2.28 — fixed in 2.2.28

How to fix

Upgrade to a fixed version: arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System 2.2.28. Check the vendor advisory for mitigations.

References

https://patchstack.com/database/vulnerability/wp-cafe/wordpress-wpcafe-plugin-2-2-27-local-file-inclusion-vulnerability?_s_id=cve
https://patchstack.com/database/vulnerability/wp-cafe/wordpress-wpcafe-plugin-2-2-27-local-file-inclusion-vulnerability?_s_id=cve

Get alerted when CVE-2024-37513 or the next vulnerability affects your stack