CVE-2026-66586: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in Themewinter WP Cafe Pro

CVE-2026-66586 is classified under CWE-98, indicating improper control of filenames for include/require statements in PHP programs. This vulnerability affects Themewinter WP Cafe Pro before version 3.0.15 and allows an attacker with high privileges to exploit local file inclusion, potentially leading to remote file inclusion. The CVSS 3.1 vector indicates network attack vector, high attack complexity, requiring high privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker with high privileges to include arbitrary files on the server, potentially leading to remote code execution, data disclosure, or denial of service. The impact is rated high on confidentiality, integrity, and availability according to the CVSS vector. However, exploitation requires high privileges and has high attack complexity, which limits the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 3.0.15, upgrading to version 3.0.15 or later is recommended once confirmed by the vendor. Until an official fix is available, restrict access to high-privilege users and review include/require statements for proper input validation.