CVE-2024-1855mediumCWE-918

CVE-2024-1855: falha de média gravidade em arraytics WPCafe – Restaurant Menu, Online…

WPCafe <= 2.2.23 - Unauthenticated Blind Server-Side Request Forgery

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%
The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.23 via the wpc_check_for_submission function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
arraytics · WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
CVEs relacionadas — arraytics WPCafe – Restaurant Menu, Online…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-75028HIGHWPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget SettingEPSS 0.7%CVE-2024-5431HIGHWPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via ShortcodeEPSS 0.6%CVE-2026-11818MEDIUMWPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST APIEPSS 0.4%CVE-2026-11601MEDIUMWPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/DeleteEPSS 0.4%CVE-2024-5427MEDIUMWPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reservation Form ShortcodeEPSS 0.3%