WPCafe CVE-2026-86812

No authentication is required and no special server configuration is needed beyond a standard WPCafe installation running on WordPress with the plugin active and version in range 3.0.10-3.0.17. The WordPress REST API must be accessible (the default state for all standard WordPress installations). The flaw is limited to the WPCafe order-management REST routes, so only guest (non-logged-in customer) order records are directly exposed through the confidentiality vector - registered-user orders may have separate protections. The sole limiting factors are: (1) the target site must have WPCafe installed and active, and (2) the site must not have globally disabled unauthenticated REST API access via a separate hardening measure.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) yields a Medium score of 6.5, which accurately bounds the impact to guest order data and order-state manipulation rather than full site takeover. The real-world urgency is higher than the numeric score implies: a publicly available exploit lowers the skill floor to near-zero, and the attack requires no authentication or special conditions whatsoever - even a mid-sized restaurant group with IT operations in sanok should treat this as urgent patching, since unauthenticated guest order enumeration directly implicates GDPR obligations around customer personal data. No CISA KEV listing is present in the input, so confirmed mass exploitation is not established, but the combination of low attack complexity and a public proof-of-concept makes opportunistic scanning plausible. EPSS data was not provided; without it, exploitation probability cannot be quantitatively stated. The S:U (no scope change) correctly reflects that exploitation stays within the WPCafe/WooCommerce data layer.

An unauthenticated attacker discovers a WordPress site running WPCafe by fingerprinting the REST API namespace (e.g., via /wp-json/) and sends HTTP requests directly to WPCafe order-management endpoints without credentials; the broken permission callback returns null, the WordPress REST dispatcher interprets this as allowed, and the attacker iterates numeric order IDs to extract guest customer names, addresses, and order details. With the same access, the attacker can mass-change order statuses to 'cancelled' or bulk-trash orders to disrupt restaurant operations. A publicly available exploit from WPScan reduces the technical barrier to this attack to near-zero.