{"id":"CVE-2026-124408","kind":"vulnerability","aliases":["CVE-2026-124408"],"related":[],"title":"WPCafe WordPress plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through 3.0.22.","summary":"The WPCafe plugin for WordPress, made by Arraytics, has a missing authorization check that lets a user reach functions they should not have access to. The sources do not say exactly which data or actions an attacker gets.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-cafe","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","self-hosted","wordpress","wp-cafe"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the WPCafe (wp-cafe) plugin is installed on your WordPress site and read its version in the plugin list or `wp plugin get wp-cafe --field=version`\n- Compare the installed version against the affected range: n/a through `3.0.22`","fix":"- WPCafe: a fixed version is not stated in the sources; the affected range runs through `3.0.22`","status":"open","published_at":"2026-11-11T12:19:47+00:00","first_seen_at":"2026-11-11T12:27:11+00:00","triaged_at":"2026-11-11T12:28:43+00:00","updated_at":"2026-11-11T12:28:43+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-11T12:28:43Z","model":"claude-haiku-5-5","output":{"fix":"- WPCafe: a fixed version is not stated in the sources; the affected range runs through `3.0.22`","reach":"internet","title":"WPCafe WordPress plugin: missing authorization check exposes access control","impact":"medium","summary":"The WPCafe plugin for WordPress, made by Arraytics, has a missing authorization check that lets a user reach functions they should not have access to. The sources do not say exactly which data or actions an attacker gets.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wp-cafe","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to restricted plugin functions on the site","analyst_note":"Confirm the fixed version and the exact unauthorized action from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124408 or the plugin's changelog.","how_to_check":"- Check whether the WPCafe (wp-cafe) plugin is installed on your WordPress site and read its version in the plugin list or `wp plugin get wp-cafe --field=version`\n- Compare the installed version against the affected range: n/a through `3.0.22`","plain_action":"","product_name":"wp-cafe","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WPCafe (wp-cafe) WordPress plugin at version `3.0.22` or earlier are in the stated range. The sources do not say which roles or settings make the flaw reachable, so the plugin's configuration and user roles are the things to review.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000765,"input_tokens":4542,"output_tokens":622,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124408':12A,15A '-2026':11A,14A '3.0.22':88C 'access':8A,50B,78C 'action':61B 'affect':83C 'allow':74C 'arrayt':34B,69C 'attack':63B 'author':5A,38B,66C 'cafe':18A,26B,73C 'check':6A,39B 'configur':77C 'control':9A,79C 'cve':10A,13A 'data':59B 'exact':57B 'exploit':75C 'expos':7A 'function':45B 'get':64B 'host':22B 'incorrect':76C 'issu':82C 'let':41B 'levels.this':81C 'made':32B 'miss':4A,37B,65C 'n/a':86C 'plugin':3A,29B 'reach':44B 'say':56B 'secur':80C 'self':21B 'self-host':20B 'sourc':53B 'user':43B 'vulner':67C 'wordpress':2A,23B,31B 'wp':17A,25B,72C 'wp-cafe':16A,24B,71C 'wpcafe':1A,28B,70C,84C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPCafe (wp-cafe) WordPress plugin at version `3.0.22` or earlier are in the stated range. The sources do not say which roles or settings make the flaw reachable, so the plugin's configuration and user roles are the things to review.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["wpcafe"],"ptokens":["cafe","wp"],"labels":["medium","other","selfhosted","vendor","wordpress","wpcafe"],"campaign_type":null,"search_a":"'-124408':12A,15A '-2026':11A,14A 'access':8A 'author':5A 'cafe':18A 'check':6A 'control':9A 'cve':10A,13A 'expos':7A 'miss':4A 'plugin':3A 'wordpress':2A 'wp':17A 'wp-cafe':16A 'wpcafe':1A","search_b":"'access':50B 'action':61B 'arrayt':34B 'attack':63B 'author':38B 'cafe':26B 'check':39B 'data':59B 'exact':57B 'function':45B 'get':64B 'host':22B 'let':41B 'made':32B 'miss':37B 'plugin':29B 'reach':44B 'say':56B 'self':21B 'self-host':20B 'sourc':53B 'user':43B 'wordpress':23B,31B 'wp':25B 'wp-cafe':24B 'wpcafe':28B","search_c":"'3.0.22':88C 'access':78C 'affect':83C 'allow':74C 'arrayt':69C 'author':66C 'cafe':73C 'configur':77C 'control':79C 'exploit':75C 'incorrect':76C 'issu':82C 'levels.this':81C 'miss':65C 'n/a':86C 'secur':80C 'vulner':67C 'wp':72C 'wp-cafe':71C 'wpcafe':70C,84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124408","severity":null,"published_at":"2026-11-11T12:19:47+00:00","modified_at":"2026-11-11T12:19:47+00:00","first_seen_at":"2026-11-11T12:27:11+00:00","fetched_at":"2026-11-11T12:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}