CVE-2024-43135

The WPCafe plugin through version 2.2.28 contains a local file inclusion vulnerability affecting certain block components accessible through the template_file parameter. Authenticated users with contributor-level permissions or higher can exploit this flaw to include and execute arbitrary files from the server, potentially running malicious PHP code. The vulnerability enables attackers to circumvent security restrictions, access confidential information, or achieve code execution by uploading benign-appearing files such as images that can then be included and processed as code.

Based on public CVE data (MITRE/NVD).