The vulnerability in Arraytics WPCafe stems from insufficient validation of filenames passed to PHP include/require statements, which permits local file inclusion. The flaw allows an attacker to read or execute arbitrary files stored on the server, potentially exposing sensitive data or enabling further attack steps. The impact is confined to WordPress sites that have the affected plugin installed.

Every installation of the WPCafe plugin with a version no newer than 2.2.32 is vulnerable, regardless of the surrounding WordPress environment.

The CVSS score of 7.5 signals high severity, while the EPSS score of less than 1% indicates a low current likelihood of exploitation. The vulnerability is not present in the CISA KEV catalog. Attackers are likely to trigger it by supplying a crafted filename to the plugin’s include logic, possibly via a URL parameter or form field; authentication is not explicitly required, so the vector is assumed to be unauthenticated. Availability of a patch in newer releases reduces the risk considerably if applied promptly.