EUVD-2026-48493
GHSA-3j3x-65ff-623h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify target WordPress site with CAFEHAUS API plugin
-
DeliveryLocate the unauthenticated password-update endpoint
-
ExploitSend forged password reset request for an admin account
-
ExecutionPassword is changed without verification
-
PersistAuthenticate as the compromised admin
-
ImpactExtract data, modify site content, or deploy further attacks.
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of CAFEHAUS API WordPress plugin. The vulnerable endpoint is exposed as soon as the plugin is activated and does not require any user interaction or non-default settings. |
| Impact | CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U, combined with the description of unauthenticated password changes, signals a low-complexity, network-exploitable vulnerability with no privileges required. However, the official CVSS score reflects only availability impact (A:H), which misaligns with the actual risk of full account takeover, suggesting a more realistic impact would be C:H/I:H/A:H. The EPSS score of 0.18% (7th percentile) indicates low probability of widespread exploitation, while the public proof-of-concept raises the risk for targeted attacks. SSVC assessment lists exploitation as 'poc', automatable, with partial technical impact. Overall, this is a high-severity vulnerability that should be prioritized for unpatched instances, though the EPSS data suggests it has not yet become a broad threat. |
| Exploit ScenarioDerived | An attacker scans for WordPress sites running the plugin, then sends a crafted HTTP POST request to the vulnerable endpoint containing a target user ID and a new password. Since no authentication is required, the password is instantly set, and the attacker can then log in as that administrator to access the dashboard, install malicious plugins, and exfiltrate data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
Account takeover in CAFEHAUS API plugin for WordPress allows unauthenticated attackers to arbitrarily reset any user password via a missing authorization endpoint. Versions up to 1.0.0 are affected, enabling complete site compromise by setting an administrator password and logging in. While a public proof-of-concept exists, no widespread exploitation has been confirmed by KEVCISA.
RemediationAI
No vendor-released patch has been identified for this vulnerability. The immediate mitigation is to completely disable and uninstall the CAFEHAUS API plugin until a fixed version is made available. If the plugin cannot be removed, block external access to the WordPress REST API endpoints related to user password updates at the web server or firewall level, but note this may break legitimate functionality if the plugin’s API is used internally. Contact the plugin developer for a patched release or consider using a web application firewall rule to block requests targeting the vulnerable route.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This WordPress plugin provides an API endpoint that handles user password updates without any authentication or authorization checks, a classic instance of CWE-269 (Improper Privilege Management). The vulnerable functionality likely resides in a REST API route registered by the plugin but missing a capability check or nonce verification, effectively exposing password changes over the network. According to CPE data, the affected product is 'cafehaus_api' for WordPress, covering all versions through 1.0.0.
Know when Cafehaus Api gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated password change leads to full admin account takeover, justifying high impact across confidentiality, integrity, and availability.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB