Now officially on WordPress.org

CVE Database / CVE-2025-30829

CVE · High

CVE-2025-30829 — WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe] < 2.2.32

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-30829 WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System [wp-cafe] < 2.2.32 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') High 7.5 < 2.2.32 2.2.32 2025-03-27 —

CVE-2025-30829

A vulnerability exists in the WPCafe plugin for WordPress, specifically in versions up to 2.2.31, where an authenticated attacker with contributor-level access or higher can exploit Local File Inclusion to execute arbitrary PHP code on the server by including and running files of their choice, potentially leading to unauthorized access, data theft, or code execution.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings