CVE-2026-11818

MediumCVSS 5.4

Published: 10/07/2026(UTC)Updated: 10/07/2026(UTC)Translated: 11/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The WPCafe plugin for WordPress up to version 3.0.14 inclusive contains an authorization bypass vulnerability. Authenticated attackers with subscriber-level access or higher can manage notification workflows intended only for administrators.

Risk Assessment

The organization is at risk of unauthorized modifications to notification workflows, potentially leading to system integrity breaches and data leaks.

Recommendation

Immediately update the WPCafe plugin to the latest available version that fixes this vulnerability.

Other vulnerabilities in WPCafe

CVE-2026-14550Medium
The WPCafe WordPress plugin before version 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator moderation workflow.

Original NVD description (English source)

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to list, create, update, delete, clone, and bulk-delete notification flow workflows that are intended to be managed only by administrators. The only protection on these endpoints is a wp_rest nonce check, which is obtainable by any logged-in user from the frontend page source.