106 matches found
WordPress WPCafe plugin 3.0.10-3.0.17 - Unauthenticated Order Disclosure and Modification vulnerability
Unauthenticated Order Disclosure and Modification vulnerability discovered by Artus KG in WordPress Plugin WPCafe versions 3.0.10-3.0.17...
CVE-2026-86812
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash...
CVE-2026-86812 WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST API
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash...
EUVD-2026-75972
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash...
CVE-2026-86812
WPCafe WordPress plugin versions 3.0.10 through 3.0.17 are affected by an authorization flaw in its food-orders REST API endpoints. The root cause is that permission callbacks return an incorrect type on failure , which bypasses access checks and allows unauthenticated users to disclose guest ord...
CVE-2026-86812 WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST API
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash...
PT-2026-89789
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash...
CVE-2026-14550
The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator...
CVE-2026-14550
WPCafe WordPress plugin versions before 3.0.18 fail to perform an authorization check when creating a reservation via its REST API, validating only a publicly available nonce . This allows unauthenticated users to submit reservations with an arbitrary approval status, effectively bypassing the ad...
WordPress WPCafe plugin < 3.0.18 - Unauthenticated Reservation Approval Bypass vulnerability
Unauthenticated Reservation Approval Bypass vulnerability discovered by ABIODUN VICTOR TAIWO in WordPress Plugin WPCafe versions 3.0.18...
EUVD-2026-66270
The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator...
CVE-2026-14550 WPCafe < 3.0.18 - Unauthenticated Reservation Approval Bypass via Missing Authorization
The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator...
CVE-2026-11818 WPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...
CVE-2026-11818
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...
WordPress WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Modification vulnerability discovered by Sushi Com Abacate in WordPress Plugin WPCafe versions = 3.0.14...
CVE-2026-57622
Subscriber Broken Access Control in WPCafe = 3.0.14 versions...
CVE-2026-57622
Subscriber Broken Access Control in WPCafe = 3.0.14 versions...
CVE-2026-57622 WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability
Subscriber Broken Access Control in WPCafe = 3.0.14 versions...