WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability

Description

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.

Affected Products

Vendor	Product	Versions
jetmonsters	restaurant menu by motopress	n/a

References

https://patchstack.com/database/wordpress/plugin/mp-restaurant-menu/vulnerability/wordpress-restaurant-menu-by-motopress-plugin-2-4-11-local-file-inclusion-vulnerability?_s_id=cve(vdb-entry)

Related News (1 articles)

Tier C

VulDB5d ago

CVE-2026-73400 | MotoPress Restaurant Menu Plugin up to 2.4.11 on WordPress file inclusion

→ No new info (linked only)

CVSS 3.18.1 HIGH

VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA KEV✅ Yes

Actively exploited✅ Yes

CWECWE-98

PublishedAug 18, 2026

Trending Score45

Source articles1

Independent1

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-28140

WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability

Trending: 5

CRITICALCVE-2026-13454EXP

MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter

MEDIUMCVE-2026-57347EXP

WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability

HIGHCVE-2026-57644EXP

WordPress Restaurant Menu by MotoPress plugin <= 2.4.10 - SQL Injection vulnerability

MEDIUMCVE-2025-63078

WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Aug 18, 2026

Added to CISA KEV

Aug 18, 2026

Discovered by ZDM

Aug 18, 2026

Actively Exploited

Aug 18, 2026