CVE-2026-27071
Missing Authorization in Arraytics WPCafe ≤ 3.0.7 Allows Unauthorized Access
Publication date: 2026-03-25
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| arraytics | wpcafe | to 3.0.7 (inc) |
| wpcafe | wp-cafe | to 3.0.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-27071 is a Missing Authorization vulnerability in the WordPress WPCafe plugin versions up to and including 3.0.7. It is a Broken Access Control issue where certain plugin functions lack proper authorization, authentication, or nonce token checks. This allows unauthenticated users to perform actions that normally require higher privileges.
The vulnerability is classified as medium priority with a high CVSS severity score of 9.1 and falls under the OWASP Top 10 category A1: Broken Access Control.
How can this vulnerability impact me? :
This vulnerability can allow attackers to perform unauthorized actions on websites using the affected WPCafe plugin, potentially compromising site integrity and security.
Because it allows unauthenticated users to bypass access controls, attackers could exploit it in mass campaigns targeting many websites, regardless of their traffic or popularity.
No official patch is available yet, and only partial mitigation exists in versions 3.0.7 and above, so immediate action such as updating the plugin or seeking professional assistance is recommended to prevent exploitation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information available about commands or methods to detect this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the WPCafe plugin to the latest version beyond 3.0.7.
If updating is not possible, seek assistance from hosting providers or web developers.
No official patch or virtual patch is currently available, so prompt remediation is important to prevent exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-27071 vulnerability is a Broken Access Control issue that allows unauthorized users to perform actions requiring higher privileges. Such unauthorized access can lead to exposure or manipulation of sensitive data, which may impact compliance with data protection standards and regulations like GDPR and HIPAA.
Failure to properly control access and protect sensitive information can result in violations of these regulations, potentially leading to legal and financial consequences for affected organizations.
Prompt remediation by updating the plugin or applying other mitigations is important to maintain compliance and reduce the risk of exploitation.