CVE-2026-27071
Received Received - Intake
Missing Authorization in Arraytics WPCafe ≤ 3.0.7 Allows Unauthorized Access

Publication date: 2026-03-25

Last updated on: 2026-04-29

Assigner: Patchstack

Description
Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-25
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2026-03-25
EPSS Evaluated
2026-06-15
NVD
CVE-2026-27071
EUVD
EUVD-2026-15773
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
arraytics wpcafe to 3.0.7 (inc)
wpcafe wp-cafe to 3.0.7 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-27071 is a Missing Authorization vulnerability in the WordPress WPCafe plugin versions up to and including 3.0.7. It is a Broken Access Control issue where certain plugin functions lack proper authorization, authentication, or nonce token checks. This allows unauthenticated users to perform actions that normally require higher privileges.

The vulnerability is classified as medium priority with a high CVSS severity score of 9.1 and falls under the OWASP Top 10 category A1: Broken Access Control.

Impact Analysis

This vulnerability can allow attackers to perform unauthorized actions on websites using the affected WPCafe plugin, potentially compromising site integrity and security.

Because it allows unauthenticated users to bypass access controls, attackers could exploit it in mass campaigns targeting many websites, regardless of their traffic or popularity.

No official patch is available yet, and only partial mitigation exists in versions 3.0.7 and above, so immediate action such as updating the plugin or seeking professional assistance is recommended to prevent exploitation.

Detection Guidance

There is no specific information available about commands or methods to detect this vulnerability on your network or system.

Mitigation Strategies

Immediate mitigation involves updating the WPCafe plugin to the latest version beyond 3.0.7.

If updating is not possible, seek assistance from hosting providers or web developers.

No official patch or virtual patch is currently available, so prompt remediation is important to prevent exploitation.

Compliance Impact

The CVE-2026-27071 vulnerability is a Broken Access Control issue that allows unauthorized users to perform actions requiring higher privileges. Such unauthorized access can lead to exposure or manipulation of sensitive data, which may impact compliance with data protection standards and regulations like GDPR and HIPAA.

Failure to properly control access and protect sensitive information can result in violations of these regulations, potentially leading to legal and financial consequences for affected organizations.

Prompt remediation by updating the plugin or applying other mitigations is important to maintain compliance and reduce the risk of exploitation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27071. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart