CVE-2026-66587: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in WPCafe WP Cafe Pro

This vulnerability in WP Cafe Pro (versions <3.0.15) arises from improper control of filenames used in include or require statements in PHP, classified as CWE-98. It allows unauthenticated attackers to perform local file inclusion, potentially leading to remote code execution. The CVSS 3.1 score is 9.8, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation level is currently provided by the vendor, and no known exploits in the wild have been reported.

Successful exploitation can lead to full compromise of the affected system, including remote code execution, data disclosure, and service disruption. The vulnerability is exploitable remotely without authentication, making it highly dangerous.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts.