CVE-2026-12981

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts...

CVE-2026-12981

The CVE-2026-12981 entry concerns the CAFEHAUS API WordPress plugin (≤ 1.0.0). The connected documents state a lack of authentication/authorization when updating user passwords, allowing unauthenticated attackers to set passwords for any user, including administrators, enabling full account takeo...

EUVD-2026-48493

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts...