Quick answers
- Is CVE-2026-66587 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66587 being exploited in the wild.
- How severe is CVE-2026-66587?
- Critical severity, with a CVSS score of 9.8, published 24 August 2026.
- Which products and versions are affected?
- WP Cafe Pro WP Cafe Pro < 3.0.15.
- Is there a fix for CVE-2026-66587?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-66587 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-66587?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a local file inclusion (LFI) vulnerability in WP Cafe Pro versions before 3.0.15, exploitable without authentication. The vulnerability allows attackers to manipulate plugin parameters to include and read arbitrary files from the server filesystem. The attack requires only network access to the WordPress site and no user interaction or prior authentication. Successful exploitation can lead to information disclosure of sensitive files, including database credentials and configuration data that may facilitate further attacks. The vulnerability is patched in version 3.0.15 and later.
Affected products
- WP Cafe Pro WP Cafe Pro < 3.0.15
Timeline
- 2026-08-20: disclosed
- 2026-08-24: advisory