EUVD-2026-42787
GHSA-vph4-6r3f-h2wc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable REST endpoints require only a subscriber account (PR:L); low complexity nonce bypass yields limited confidentiality and integrity impact with no availability consequence.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WPCafe - Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to list, create, update, delete, clone, and bulk-delete notification flow workflows that are intended to be managed only by administrators. The only protection on these endpoints is a wp_rest nonce check, which is obtainable by any logged-in user from the frontend page source.
AnalysisAI
Authorization bypass in the WPCafe WordPress plugin (all versions through 3.0.14) allows any authenticated subscriber-level user to fully manage email notification flow workflows that are intended to be administrator-only. The FlowAPI REST endpoints bundled within the plugin's email notification SDK rely solely on a wp_rest nonce for access control - a token freely obtainable from the frontend page source by any logged-in user - completely bypassing role-based authorization. No public exploit or active exploitation has been identified at time of analysis, though the low exploitation complexity makes this a realistic risk on sites with open user registration.
Technical ContextAI
WPCafe is a WordPress plugin by Arraytics (CPE: cpe:2.3:a:arraytics:wpcafe_-_restaurant_menu,_online_food_ordering_&_table_booking_system:*:*:*:*:*:*:*:*) providing restaurant operations functionality including online food ordering and table booking. The vulnerable code resides in a vendored third-party SDK at vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php, which registers multiple WordPress REST API endpoints (documented at lines 66, 74, 82, 102, 110, and 121) for CRUD operations on notification workflow configurations. CWE-862 (Missing Authorization) is the root cause: each endpoint performs a wp_rest nonce validation via check_ajax_referer or equivalent, but never validates that the authenticated user holds a capability such as manage_options or a custom administrator-level capability before allowing workflow manipulation. Because WordPress issues a wp_rest nonce to any logged-in user and embeds it in frontend page source, the nonce check provides zero meaningful authorization boundary. Version 3.0.15 relocates the relevant logic to core/email-automation/Service/email-notification.php, indicating a refactor that presumably introduces proper capability checks.
RemediationAI
Upgrade WPCafe to version 3.0.15 or later, which refactors the email notification automation layer and addresses the missing capability check (patched files visible at plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.15/core/email-automation/Service/email-notification.php). Until patching is feasible, disable open WordPress user registration to eliminate the subscriber-level account prerequisite - this is the most effective compensating control and carries no functional trade-off for restaurant sites that do not need public account creation. Alternatively, use a WAF rule or security plugin (such as Wordfence) to restrict unauthenticated or low-privilege access to the /wp-json/ REST API routes associated with WPCafe's notification flow endpoints; note that overly broad REST API blocking may interfere with legitimate plugin operations including order processing. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/9cf2d3bd-359c-4334-ad28-b6b9722edd1c for additional guidance.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today