CVE-2026-86812
Received Received - Intake

Unauthenticated Order Data Access in WPCafe WordPress Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: WPScan

Description
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash, any order.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-86812
EUVD
EUVD-2026-75972

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wpcafe wpcafe to 3.0.18 (exc)
wpcafe wpcafe From 3.0.10 (inc) to 3.0.17 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WPCafe WordPress plugin before version 3.0.18 has a vulnerability where certain order-management REST endpoints do not properly restrict access. This happens because their permission callbacks return an incorrect type when access is denied, allowing unauthenticated users to view guest order information and modify or delete any order.

Detection Guidance

Check if your WPCafe plugin version is between 3.0.10 and 3.0.17. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details. Test REST API endpoints like '/wp-json/wpcf/v3/food-orders' for unauthorized access.

Impact Analysis

Unauthenticated attackers can access sensitive guest order details, change the status of any order, or delete orders entirely. This could lead to data leaks, disrupted operations, or loss of critical order information for businesses using the plugin.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data in guest orders without authorization. For HIPAA, if order data includes protected health information, unauthorized access or modification could breach compliance. Both standards require strict access controls and data protection.

Mitigation Strategies

Update the WPCafe plugin to version 3.0.18 or later immediately. If updating is not possible, disable the plugin temporarily or restrict access to the REST API endpoints until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86812. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart