WPCafe EUVD-2026-66270

No authentication is required; the CVSS vector confirms PR:N. The only prerequisite is network access to a WordPress installation with the WPCafe plugin active in a version prior to 3.0.18, plus retrieval of a valid nonce from the site's public HTML - a trivial step that requires no credentials or elevated access. Exploitation is strictly bounded to the reservation subsystem of the WPCafe plugin: the attacker cannot read, modify, or delete arbitrary data, cannot access other WordPress functionality, and cannot escalate privileges or affect the underlying server. Sites not running WPCafe, or sites running version 3.0.18 or later, are entirely unaffected. The key limiting factor is the narrow WordPress plugin footprint - this is not a WordPress core issue.

The CVSS 3.1 base score of 5.3 (Medium) accurately reflects the constrained technical impact: only low-level integrity is affected, with no confidentiality or availability impact and no scope change. EPSS at 0.19% (9th percentile) corroborates that widespread exploitation has not materialized at the time of analysis, despite the trivially low attack complexity created by the public nonce and unauthenticated attack vector. However, the operational risk to affected businesses can exceed what the CVSS score suggests - even a mid-sized municipal IT team in zabrze running a WordPress-based café or restaurant site should treat this as a meaningful workflow-integrity issue, given that auto-approved reservations translate directly to real-world service obligations (held tables, committed meal orders) that staff may fulfill without realizing the booking was never reviewed. The CVE is not listed in the CISA KEV catalog, but a public proof-of-concept is available through WPScan, lowering the effective barrier for non-technical actors. The primary risk is business-logic abuse and operational disruption rather than system compromise or data exfiltration.

An unauthenticated attacker visits a WordPress site running the affected WPCafe plugin, retrieves a valid nonce from the public page source, and sends a crafted POST request to the plugin's reservation REST API endpoint with the approval_status field set to an approved state. The reservation is written to the database as administrator-approved without triggering the moderation workflow, and restaurant staff may fulfill the fraudulent or spam booking without realizing it was never reviewed. A public proof-of-concept demonstrating this request flow is available through the WPScan advisory.