A local file inclusion flaw exists in the WP Cafe Pro plugin for WordPress. The vulnerability allows an attacker to specify a file path that the plugin will include and execute on the server. This can expose sensitive files or, in some cases, allow execution of arbitrary PHP code, thereby compromising the integrity and confidentiality of the web application. The weakness is a classic input validation problem, classified as CWE‑98, and can lead to a severe breach if not mitigated.

The flaw affects installations of the Themewinter WP Cafe Pro plugin on WordPress sites that run any version older than 3.0.15. All users who have not applied the latest patch are potentially vulnerable.

The CVSS score of 6.6 indicates moderate severity. The EPSS score is not disclosed, and the vulnerability is not listed in the CISA KEV catalog. Although the official description does not state the exact attack vector, it is inferred that the flaw can be triggered by supplying a crafted request parameter to the plugin’s file inclusion endpoint, enabling an unauthenticated remote attacker to influence the included file path.