CVE-2024-1855: Themewinter Wpcafe

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.23 via the wpc_check_for_submission function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application.

Affected products

• Themewinter Wpcafe: before 2.2.24 (fixed in 2.2.24)

Published 2024-05-23. Last modified 2026-06-17.