Skip to content
PluginCanary

WPCafe

WPCafe - Restaurant Menu, Online Food Ordering & Table Booking System
by Arraytics · 5,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: maintained, last release 19 Oct 2026, 36 releases in 24 months, no unpatched vulnerabilities.

81/ 100 Canary Score
Sub-scores for WPCafe
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Quick answers

Is WPCafe still maintained?
Yes. Last release 19 Oct 2026, 36 releases in the last 24 months. 19 Oct 2026 · wordpress.org
Who owns WPCafe, and has it changed hands?
No change recorded. Main committer themewinter since May 2020. 3 Nov 2026 · SVN log
Was WPCafe removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is WPCafe safe?
17 known vulnerabilities, all fixed (latest in 3.0.21). Not on the exploited list. 5 Oct 2026 · Wordfence Intelligence
Is the latest WPCafe update safe to install?
No ownership change before 3.0.23. No one-star spike after it. 19 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master9 May 2020 to 9 May 2020, 1 commits
themewinter21 May 2020 to 17 Mar 2025, 153 commits
ehsanriyadh12 Apr 2025 to 19 Oct 2026, 48 commits

3 committers recorded. No ownership change since 2020.

Maintenance

Last release
16 days ago
Releases, 24 months
36
Tested up to
7.1 current
Requires PHP
8.0 supported 8.2+
Releases per quarter
Releases per quarter for WPCafe
Q1 20243
Q2 20244
Q3 20242
Q4 20241
Q1 20251
Q2 20254
Q3 20254
Q4 20255
Q1 20265
Q2 20268
Q3 20266
Q4 20262

Last release 19 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.6.

Rating distribution
5 star100
4 star2
3 star2
2 star0
1 star9

Security record

10 vulnerabilities in 24 months (17 on record), all patched (latest fixed in 3.0.21).

Show 17 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
5 Oct 2026WPCafe <= 3.0.20 - Unauthenticated Information Exposure5.3<= 3.0.203.0.21Patched before disclosure
2 Oct 2026WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting7.5<= 3.0.183.0.19Patched before disclosure
2 Oct 2026WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete5.3<= 3.0.193.0.20Patched before disclosure
11 Sep 2026WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System 3.0.10 - 3.0.17 - Missing Authorization5.33.0.10 to 3.0.173.0.18Patched before disclosure
26 Aug 2026WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System < 3.0.18 - Missing Authorization5.3< 3.0.183.0.18Patched before disclosure
9 Jul 2026WPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API5.4<= 3.0.143.0.15Patched before disclosure
25 Jun 2026WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System <= 3.0.14 - Missing Authorization4.3<= 3.0.143.0.15Patched before disclosure
12 Mar 2026WPCafe – Restaurant Menu, Online Food Ordering and Reservation Booking Solution <= 3.0.7 - Missing Authorization5.3<= 3.0.73.0.823
17 Apr 2025WPCafe <= 2.2.32 - Authenticated (Contributor+) Local File Inclusion8.8<= 2.2.322.2.33Patched before disclosure
27 Mar 2025WPCafe <= 2.2.31 - Authenticated (Contributor+) Local File Inclusion8.8<= 2.2.312.2.32Patched before disclosure
7 Aug 2024WPCafe <= 2.2.28 - Authenticated (Contributor+) Local File Inclusion8.8<= 2.2.282.2.29Patched before disclosure
5 Jul 2024WPCafe <= 2.2.27 - Authenticated (Contributor+) Local File Inclusion8.8<= 2.2.272.2.28Patched before disclosure
24 Jun 2024WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcode8.8<= 2.2.252.2.26Patched before disclosure
30 May 2024WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reservation Form Shortcode6.4<= 2.2.242.2.26Patched before disclosure
22 May 2024WPCafe <= 2.2.23 - Unauthenticated Blind Server-Side Request Forgery5.3<= 2.2.232.2.24Patched before disclosure
15 Nov 2023WPCafe <= 2.2.22 - Missing Authorization5.3<= 2.2.222.2.23117
6 Aug 2022WPCafe – Food Menu, WooCommerce Food Ordering, Food Delivery, Pickup and Restaurant Reservation <= 2.1.4 - Cross-Site Scripting7.2<= 2.1.42.2.0Patched before disclosure

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 1 support threads resolved in the last 2 months.

Momentum

5,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WPCafe
4 May 2026480
11 May 20262,242
18 May 20262,494
25 May 2026668
1 Jun 20262,112
8 Jun 2026732
15 Jun 20262,028
22 Jun 20262,656
29 Jun 2026978
6 Jul 2026932
13 Jul 20262,402
20 Jul 2026634
27 Jul 2026547
3 Aug 2026876
10 Aug 20262,426
17 Aug 20262,029
24 Aug 20261,366
31 Aug 20262,375
7 Sep 2026558
14 Sep 2026753
21 Sep 20262,423
28 Sep 20262,708
5 Oct 20261,377
12 Oct 20262,085
19 Oct 20262,201
26 Oct 2026989
2 Nov 2026123

Weekly downloads over the last 4 weeks are 12% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

No healthier plugin in the same category yet.

Facts

Version3.0.23
AuthorArraytics
Added21 May 2020
Last updated19 Oct 2026
Active installs5,000+
Requires WordPress6.2
Tested up to7.1.4
Requires PHP8.0
CategoryE-commerce & Shopping > Product Management & Catalogs
Tagsbooking, food menu, restaurant, reservation, Food Delivery

Other plugins by this author: Eventin - Events Calendar, Tickets, Registration, Booking & WooCommerce, Timetics - Appointment Booking Calendar & Scheduling, Eventin Addons for Divi Builder, Booktics - Appointment Booking Calendar for Service Businesses, WPCafe Elementor Addon - Restaurant Menu, Ordering and Reservation Widgets, Eventin Addon for Elementor, Aisentic - AI Copilot for WordPress Dashboard, WPCafe Multivendor Restaurant Addon for Dokan, Loyalty Points and Rewards Plugin for WordPress - Pointics, Eventin Addon for TutorLMS, Eventin Addon for FluentCart, WPCafe Restaurant Addon for Oxygen Builder

Questions

Is WPCafe still maintained?

Yes. Last release 19 Oct 2026, 36 releases in the last 24 months.

Who owns WPCafe, and has it changed hands?

No change recorded. Main committer themewinter since May 2020.

Was WPCafe removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is WPCafe safe?

17 known vulnerabilities, all fixed (latest in 3.0.21). Not on the exploited list.

Is the latest WPCafe update safe to install?

No ownership change before 3.0.23. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue