CVE-2026-75028

Summary

The WPCafe WordPress plugin contains a Local File Inclusion vulnerability that allows authenticated users with contributor-level access or higher to include and execute arbitrary PHP files on the server. This can lead to full code execution and data compromise.

Exploitability

Exploitation requires an authenticated user with contributor privileges or higher, making it moderately difficult but achievable through social engineering or compromised accounts, with no additional preconditions beyond standard WordPress authentication.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the WordPress server, potentially leading to complete site compromise, data exfiltration, and further lateral movement within the hosting environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.0.19 or later to remediate the LFI vulnerability in the WPCafe plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.