This vulnerability, classified under CWE-98, involves improper control of filenames in include or require statements within the WP Cafe Pro plugin for WordPress. It allows unauthenticated attackers to perform local file inclusion (LFI) on affected versions before 3.0.15. The CVSS 3.1 base score is 9.8, indicating a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been provided in the available data, and no known exploits are reported in the wild as of the publication date.

Successful exploitation can lead to remote code execution, full system compromise, and unauthorized disclosure or modification of data. The vulnerability is exploitable remotely without authentication, making it highly dangerous for affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 3.0.15, upgrading to version 3.0.15 or later is recommended once the vendor releases an official fix. Until then, restrict access to vulnerable endpoints and monitor for suspicious activity related to file inclusion attempts.