Wpcafe CVE-2026-27071

Remote unauthenticated attacker can exploit WPCafe WordPress plugin version <= 3.0.7 via missing authorization checks in access control. Requires plugin installed and activated on WordPress site. No user interaction needed.

While CVSS and EPSS scores are not available for this CVE, the vulnerability presents significant real-world risk based on other signals. The attack vector is network-based and requires no special privileges or user interaction, suggesting medium-to-high exploitability. The broken access control nature of the vulnerability means that exploitation requires no sophisticated techniques—attackers can directly request restricted functionality without complex payloads. The plugin's popularity in WordPress ecosystem, combined with the fact that authorization flaws are among the most commonly exploited vulnerability classes in web applications, elevates practical risk despite the absence of a formal CVSS score. The Patchstack report and ENISA tracking indicate this has been validated by multiple security researchers. Without KEV status or POC confirmation in the provided data, the actual exploitation rate remains unclear, but authorization bypass vulnerabilities typically see rapid weaponization once disclosed. This should be treated as a high-priority issue warranting immediate patching across all affected installations.

An unauthenticated attacker or low-privileged user could directly access WPCafe plugin functionality that should be restricted to administrators or specific user roles. For example, an attacker could bypass authorization checks to view sensitive cafe data, modify menu items and pricing, access customer orders, or manipulate reservation and booking systems without possessing the necessary WordPress capabilities. Because the vulnerability is a missing authorization check rather than requiring complex exploitation techniques, an attacker with basic knowledge of WordPress plugin structure could enumerate accessible endpoints and identify unprotected functions by simply crafting HTTP requests to the plugin's AJAX handlers or page handlers without authentication tokens or role verification.