WordPress WPCafe plugin < 3.0.21 - Unauthenticated Product Data Disclosure vulnerability

Unauthenticated Product Data Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin WPCafe versions 3.0.21...

CVE-2026-86816

The WPCafe WordPress plugin, in versions before 3.0.21 , contains a vulnerability where certain REST API endpoints do not have proper access restrictions. This flaw allows unauthenticated attackers to access sensitive WooCommerce product data , including private product meta, exact stock levels, ...