CVE-2026-66587 CRITICAL

CVE-2026-66587: WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Vendor Wpcafe
Product WP Cafe Pro
Weakness CWE-98 · PHP file inclusion
Published August 24, 2026
Last update August 24, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

Explanation of Vulnerability in Simple Terms

02Summary

WP Cafe Pro versions before 3.0.15 contain a remote file inclusion vulnerability that allows unauthenticated attackers to execute arbitrary PHP code on the site. The vulnerability requires no user interaction and can be exploited over the network. An attacker can gain full control of the affected WordPress installation.

What an attacker can do

03Attacker Capabilities

Run their own PHP code on the site and take complete control of it.

Potential impact on your site

04Site Impact

Complete compromise of the WordPress site, including data theft, malware installation, and site defacement.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 24, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-57791 WordPress Brook theme <= 2.9.0 - Local File Inclusion vulnerability CVE-2016-20077 WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php CVE-2026-42382 WordPress Audrey theme <= 1.5 - Local File Inclusion vulnerability CVE-2026-13080 WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter CVE-2026-57804 WordPress TheGem theme Elements (for Elementor) plugin <= 5.11.1 - Local File Inclusion vulnerability