EUVD-2026-91964
GHSA-p5w3-2x8f-ffvj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend request to FlowAPI endpoint
-
ExploitBypass missing authorization check
-
ExecutionOverwrite or delete email flow
-
ImpactSend phishing emails from legitimate address
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the WPCafe WordPress plugin: the Email_Automation_Service_Provider::is_enable() method unconditionally returns true, the FlowAPI endpoints are active on every installation without any configuration, and five default email flows are present upon activation. The only limiting factor is impact scope: exploitation affects only the plugin's email notification flows (reading, creating, updating, cloning, deleting reservation/admin email flows and their content), not the broader WordPress site, database, or filesystem; abuse of the site's legitimate sending address makes the practical risk phishing and notification denial rather than system compromise. |
| Impact | All exploitability signals point to easy abuse: the provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes fully remote, network-reachable, low-complexity exploitation with no authentication (PR:N) and no user interaction, and the description confirms the vulnerable endpoints are active by default with no configuration requirement because Email_Automation_Service_Provider::is_enable() unconditionally returns true. These factors would normally elevate priority. However, the impact is deliberately scoped: NVD/Wordfence assigned only C:N/I:L/A:N for a base score of 5.3 (MEDIUM), reflecting that the damage is confined to the plugin's email notification flows (overwriting/cloning/deleting reservation confirmation, cancellation, and admin-alert emails), not full site or data compromise. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The most under-weighted real-world risk is abuse of the site's legitimate sending address to deliver attacker-controlled content - a convincing phishing/social-engineering vector - plus denial of reservation notifications; I would argue the official score understates confidentiality (attackers can read flows) and availability (attackers can destroy flows), so an independent assessment lands higher than 5.3. Net: a genuine but moderate-priority issue - trivially exploitable and broadly default-on, but limited blast radius rather than a critical RCE-class flaw. |
| Exploit ScenarioDerived | An unauthenticated attacker sends crafted requests to the WPCafe FlowAPI endpoints, which are enabled by default on every installation, to overwrite the default reservation-confirmation email flow with attacker-controlled content. Subsequent reservation emails are then sent from the site's own legitimate address, enabling convincing phishing or fraud against customers, or the attacker deletes the flows to suppress all reservation notifications. No public exploit was identified in the provided data, but the missing authorization check (AV:N/AC:L/PR:N) makes exploitation straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 03, 2026
Unauthenticated attackers can read, create, update, clone, and delete the email notification flows of the WPCafe - Restaurant Menu, Online Food Ordering & Table Booking System WordPress plugin in all versions up to and including 3.0.19, because the plugin fails to verify that a caller is authorized before processing flow-management requests (CWE-862). The exposed endpoints require no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), no user interaction, and no special configuration, since Email_Automation_Service_Provider::is_enable() unconditionally returns true and five pre-configured email flows ship with the plugin on activation; the practical result is attacker-controlled reservation confirmation, cancellation, and admin alert emails sent from the site's legitimate address, plus outright destruction of those flows. No public exploit code identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV); the supplied assessment rates impact as low across confidentiality, integrity, and availability and constrains the damage to the plugin's email notification subsystem rather than the wider WordPress site.
RemediationAI
No vendor-released patch identified at time of analysis - the affected range in the supplied intelligence ends at version 3.0.19 with no fixed version listed, so verify the plugin's WordPress.org changelog and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/c01a06ca-ba3f-4e61-a17c-86d5e9f53ebf?source=cve) for a subsequent release before assuming remediation exists. Because is_enable() unconditionally returns true, there is no in-plugin setting that turns the vulnerable email automation endpoints off, so the only complete mitigation is to deactivate and remove the WPCafe plugin until a fixed build is available; the trade-off is loss of all menu, ordering, and table-booking functionality. If the site must keep operating, place a WAF or reverse-proxy rule that blocks unauthenticated requests reaching the email-notification SDK flow endpoints (the FlowAPI routes reachable via admin-ajax.php/REST used by themewinter/email-notification-sdk) from any source without a valid logged-in session or nonce, accepting that this may break legitimate front-end-triggered notification behavior and requires testing against normal reservation and order traffic. Since attacker-authored mail is sent from the site's own legitimate address, treat the messaging as a phishing vector: monitor outbound mail for unexpected reservation confirmation, cancellation, or admin alert templates, alert customers not to trust such emails, and rotate/review any workflow that relies on those notifications. Note also that exploitation is limited to the plugin's email flows - the wider WordPress site, database, and filesystem are not directly reachable through this flaw, so emergency containment should be scoped accordingly rather than treated as full site compromise.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization) in the plugin's bundled email automation component. WPCafe (vendor: Arraytics) embeds the themewinter/email-notification-sdk, whose FlowAPI class exposes flow operations without capability checks or a WordPress permission_callback - the referenced source lines (FlowAPI.php#L58, #L138, #L156, #L282 in tags 3.0.8 and 3.0.13) correspond to the read/create/update/delete/clone handlers for email notification flows, and the same tagged releases expose helper and localized-data paths (Utils/Helpers.php#L20, core/assets/localize.php#L47) relevant to how those requests are routed and authorized. The email-automation-service-provider.php#L43 flag is_enable() returns true unconditionally, so the email automation surface is live on every installation regardless of any admin setting, and five default flows are registered at activation, giving an attacker pre-existing targets. The CPE cpe:2.3:a:arraytics:wpcafe_-_restaurant_menu,_online_food_ordering_&_table_booking_system:*:*:*:*:*:*:*:* pins the affected product family to the Arraytics WPCafe WordPress plugin. Because the flows control transactional mail content and the sender is the site's own configured address, the vulnerability class effectively turns into notification tampering/phishing and notification denial rather than code execution, SQL injection, or file access - consistent with the assessed vector's low C/I/A ratings confined to the plugin scope.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated remote access to default-on endpoints gives AV:N/AC:L/PR:N/UI:N; attackers can read flows (C:L), overwrite content (I:L), and destroy flows (A:L), all limited to the email-notification feature.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WPCafe - Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, clone, and delete email notification flows, including overwriting the default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content sent from the site's legitimate address, or destroying reservation notification flows entirely. The vulnerable endpoints are active by default on every WPCafe installation without any configuration requirement, as the Email_Automation_Service_Provider::is_enable() method unconditionally returns true and the plugin ships with five pre-configured default email flows upon activation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB