Arbitrary file read via include path traversal

Local file inclusion in MotoPress Restaurant Menu 2.4.11 and earlier allows remote attackers to read arbitrary server files via crafted paths. Public records map the flaw to improper filename control in PHP include or require handling, but the vendor-linked advisory does not identify the specific endpoint, parameter, or code path that accepts the attacker-supplied path. No authentication is required, and the disclosed impact is file disclosure that could expose credentials and enable broader compromise depending on which local files the web process can read.