What is the CVSS score of CVE-2026-57622?

CVE-2026-57622 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

WPCafe CVE-2026-57622

EUVD-2026-39742 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-g4pp-jwh8-2p64

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint requires only a subscriber account (PR:L); missing authorization yields read-only data access (C:L), no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:15 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.

AnalysisAI

Broken access control in the WPCafe WordPress plugin (versions 3.0.14 and earlier) allows authenticated subscriber-level users to access restricted functionality or data without proper authorization checks. The flaw stems from missing authorization (CWE-862) on one or more plugin endpoints, permitting low-privileged WordPress accounts to bypass intended access restrictions. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible, low-complexity nature of the issue makes it straightforward to abuse by any registered site user.

Technical ContextAI

WPCafe is a WordPress plugin designed for restaurant and cafe online ordering workflows, typically integrated with WooCommerce. The vulnerability class is CWE-862 (Missing Authorization), meaning one or more AJAX handlers, REST API endpoints, or admin-facing functions in the plugin fail to verify whether the requesting user holds sufficient capability before executing privileged logic or returning sensitive data. WordPress defines a role hierarchy (subscriber → contributor → author → editor → administrator); this flaw is specifically exploitable at the subscriber tier - the default role granted to any registered user - indicating the missing check is absent even at the lowest authenticated access level. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms exploitation is network-reachable, requires no special conditions, and yields read-access to restricted data without affecting integrity or availability.

RemediationAI

The primary remediation is to update the WPCafe plugin to a version beyond 3.0.14 as soon as a patched release is confirmed available; refer to the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-cafe/vulnerability/wordpress-wpcafe-plugin-3-0-14-broken-access-control-vulnerability for the confirmed fixed version. No explicit fixed version number was provided in the source data, so administrators should monitor the plugin's WordPress.org changelog for a release that addresses this issue. As a compensating control pending a patch, site administrators should disable open user registration (Settings → General → uncheck 'Anyone can register') to eliminate the unauthenticated path to subscriber account creation, substantially reducing exposure. If subscriber accounts are required for site functionality, consider using a Web Application Firewall (WAF) rule - for example, Patchstack's virtual patching feature - to block exploitation of the specific vulnerable endpoint until the code-level fix is applied. Deactivating the plugin entirely is a high-impact workaround that eliminates the vulnerability at the cost of losing all WPCafe ordering functionality.