WPCafe CVE-2026-86816

Exploitation requires the WPCafe plugin at a version before 3.0.21 installed alongside an active WooCommerce store that contains products (the disclosed data - sales counts, stock levels, private product meta - only exists when WooCommerce is present and populated). No authentication, user interaction, or non-default configuration is needed: the affected REST API endpoints fail to restrict access in the default state (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is the WooCommerce dependency - sites running WPCafe without WooCommerce product data have nothing meaningful to disclose - and the impact is confined to reading data, with no write or availability consequences.

This is a moderate-severity information disclosure flaw (CWE-200) with a self-consistent set of signals rather than conflicting ones. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) indicates remote, low-complexity, unauthenticated access with low confidentiality impact and no integrity or availability impact - consistent with the description of unprotected REST API endpoints leaking WooCommerce product data. Publicly available exploit code exists (reported by WPScan), which raises practical risk because the attack is trivial to reproduce, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation at this time. The realistic priority is MEDIUM: easy to exploit and POC-backed, but the impact is bounded to confidentiality of business data (sales counts, stock levels, private product meta) with no code execution or data modification. No EPSS, SSVC, or KEV data was supplied, so automatability and real-world exploitation volume cannot be quantified from the input - treat the POC existence, not confirmed exploitation, as the key escalating factor.

An unauthenticated attacker sends crafted HTTP requests directly to the plugin's unprotected WPCafe REST API endpoints on a target WordPress/WooCommerce store and receives product data - including per-product sales counts, exact stock levels, and private product meta - that WooCommerce normally keeps behind authentication. Public exploit code from WPScan lowers the barrier, and the low attack complexity (AC:L) with no required privileges or user interaction means the request can be automated and scripted against many sites.