CVE-2026-11818mediumCWE-862

CVE-2026-11818: falha de média gravidade em arraytics WPCafe – Restaurant Menu, Online…

WPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API

Publicada em

Seguir esta CVE+ Monitorar WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.4%
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to list, create, update, delete, clone, and bulk-delete notification flow workflows that are intended to be managed only by administrators. The only protection on these endpoints is a wp_rest nonce check, which is obtainable by any logged-in user from the frontend page source.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
arraytics · WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
CVEs relacionadas — arraytics WPCafe – Restaurant Menu, Online…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-75028HIGHWPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget SettingEPSS 0.7%CVE-2024-5431HIGHWPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via ShortcodeEPSS 0.6%CVE-2024-1855MEDIUMWPCafe <= 2.2.23 - Unauthenticated Blind Server-Side Request ForgeryEPSS 0.4%CVE-2026-11601MEDIUMWPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/DeleteEPSS 0.4%CVE-2024-5427MEDIUMWPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reservation Form ShortcodeEPSS 0.3%