WP Cafe Pro CVE-2026-66585

No authentication is required and no special configuration must be present beyond the plugin being installed and active on a WordPress site accessible over the network - the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms exploitation against a default installation of WP Cafe Pro < 3.0.15. The limiting factors are: the target must be running WordPress with WP Cafe Pro installed and active; the site must be network-accessible (publicly internet-facing or reachable within the attacker's network); and impact is constrained to confidentiality only (no write or denial-of-service capability). The specific endpoint or feature triggering the exposure is not detailed in available intelligence.

The CVSS 7.5 High score is well-supported by the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N): network-reachable, low complexity, no authentication, and high confidentiality impact. These signals indicate that exploitation is straightforward and broadly accessible to any internet-facing site running the affected plugin. No EPSS data was provided, and no CISA KEV listing exists, suggesting no confirmed mass or widespread exploitation campaigns at time of writing. No public proof-of-concept has been identified, which slightly lowers immediate risk compared to a KEV-listed flaw. The primary risk is targeted reconnaissance or opportunistic scanning against WordPress installations; the actual data exposed (reservation details, customer PII, credentials, or API keys) is unspecified in available intelligence, so the real-world blast radius depends on what sensitive data the plugin handles in a given deployment. The absence of integrity or availability impact confines the threat to information disclosure, but exposure of customer or payment-adjacent data in hospitality environments could carry significant compliance consequences.

An attacker scans for WordPress sites running WP Cafe Pro using fingerprinting techniques (e.g., checking for plugin assets in page source), then sends a crafted unauthenticated HTTP request to a vulnerable AJAX or REST API endpoint exposed by the plugin. The server responds with sensitive data - potentially customer records, reservation details, or internal configuration - without requiring any login or special session. No proof-of-concept has been publicly identified, but the low complexity of the CVSS vector indicates the attack is trivially replicable once the endpoint is known.