What is the CVSS score of EUVD-2026-48493?

EUVD-2026-48493 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for EUVD-2026-48493?

Yes, a public proof-of-concept exploit is available for EUVD-2026-48493. Prioritise patching immediately. EPSS: 0.2%.

CAFEHAUS API WordPress plugin EUVD-2026-48493

| CVE-2026-12981 HIGH

Improper Privilege Management (CWE-269)

2026-07-24 WPScan

GHSA-3j3x-65ff-623h

Privilege Escalation WordPress Cafehaus Api

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated password change leads to full admin account takeover, justifying high impact across confidentiality, integrity, and availability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 11:55 vuln.today

CVSS changed

Jul 24, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jul 24, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

Jul 24, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.

AnalysisAI

Account takeover in CAFEHAUS API plugin for WordPress allows unauthenticated attackers to arbitrarily reset any user password via a missing authorization endpoint. Versions up to 1.0.0 are affected, enabling complete site compromise by setting an administrator password and logging in. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify target WordPress site with CAFEHAUS API plugin

Delivery

Locate the unauthenticated password-update endpoint

Exploit

Send forged password reset request for an admin account

Execution

Password is changed without verification

Persist

Authenticate as the compromised admin

Impact

Extract data, modify site content, or deploy further attacks.

Access

Identify target WordPress site with CAFEHAUS API plugin

Delivery

Locate the unauthenticated password-update endpoint

Exploit

Send forged password reset request for an admin account

Execution

Password is changed without verification

Persist

Authenticate as the compromised admin

Impact

Extract data, modify site content, or deploy further attacks.

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation against default configurations of CAFEHAUS API WordPress plugin. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U, combined with the description of unauthenticated password changes, signals a low-complexity, network-exploitable vulnerability with no privileges required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker scans for WordPress sites running the plugin, then sends a crafted HTTP POST request to the vulnerable endpoint containing a target user ID and a new password. Since no authentication is required, the password is instantly set, and the attacker can then log in as that administrator to access the dashboard, install malicious plugins, and exfiltrate data.
Remediation	No vendor-released patch has been identified for this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report.