CVE-2026-75028 is a Local File Inclusion vulnerability (CWE-98) in the WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System WordPress plugin by arraytics. The vulnerability exists in the template scope function and affects all versions up to and including 3.0.18. It allows authenticated attackers with contributor-level privileges or higher to include arbitrary PHP files on the server, enabling execution of arbitrary PHP code. This can result in bypassing access controls, unauthorized data access, or remote code execution if an attacker can upload PHP files.

An attacker with contributor-level access or higher can exploit this vulnerability to execute arbitrary PHP code on the server by including malicious PHP files. This can lead to full compromise of the affected WordPress site, including bypassing access controls and accessing sensitive data. The CVSS 3.1 score is 7.5 (High), reflecting network attack vector, low privileges required, and high impact on confidentiality, integrity, and availability.

No official patch or fix is currently documented. Users should check the vendor's advisory for updates. Until a fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity. Avoid uploading PHP files or other executable content through the plugin. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.