What is the CVSS score of CVE-2026-27071?

CVE-2026-27071 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Wpcafe are affected by CVE-2026-27071?

Organizations using Missing Authorization vulnerability in Arraytics WPCafe wp-cafe face critical risk from CVE-2026-27071, a missing authorization vulnerability rated CVSS 9.1.

How to fix or mitigate CVE-2026-27071?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Wpcafe CVE-2026-27071

EUVD-2026-15773 CRITICAL

Missing Authorization (CWE-862)

2026-03-25 Patchstack

WordPress Authentication Bypass Wpcafe Wordpress Plugin Arraytics

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15773

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.1

DescriptionCVE.org

Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7.

AnalysisAI

A missing authorization vulnerability exists in Arraytics WPCafe WordPress plugin versions up to 3.0.7, where incorrectly configured access control allows attackers to bypass authentication and authorization checks. This broken access control flaw (CWE-862) enables unauthorized users to perform actions they should not have permission to execute, potentially leading to unauthorized data access, modification, or plugin functionality abuse. The vulnerability affects all installations of WPCafe through version 3.0.7 and is tracked under ENISA EUVD ID EUVD-2026-15773 with confirmation from Patchstack vulnerability research.

Technical ContextAI

The vulnerability resides in the Arraytics WPCafe plugin (CPE: cpe:2.3:a:arraytics:wpcafe:*:*:*:*:*:*:*:*), a WordPress plugin for cafe and restaurant management. The root cause is classified under CWE-862 (Missing Authorization), which indicates that the plugin fails to properly enforce access control checks before allowing users to perform sensitive operations. Rather than a cryptographic or protocol flaw, this is an application-level authorization defect where the plugin does not adequately verify user roles and capabilities before granting access to restricted functionality. WordPress plugins typically control access through WordPress's capability system (wp_capability_check), and this vulnerability suggests the plugin either omits these checks entirely, implements them incorrectly, or uses a custom authorization scheme with logical flaws that can be bypassed.

RemediationAI

Administrators should immediately upgrade the WPCafe plugin to a patched version beyond 3.0.7 if such a release is available from Arraytics. Check the official Arraytics WPCafe plugin repository or the vendor's security advisories for the latest patched version and apply it without delay. Until a patch is available, consider disabling the WPCafe plugin entirely if it is not critical to operations, or restrict access to the plugin's administrative functions by limiting WordPress admin panel access to trusted IP addresses via web server configuration or WordPress security plugins. Additionally, implement comprehensive logging and monitoring of plugin functionality to detect unauthorized access attempts, and review user roles and capabilities to ensure the principle of least privilege is enforced. Contact Arraytics support directly for confirmation of patch availability and release dates if upgrading immediately is not possible.