CVE-2026-11601: WPCafe WordPress Auth Bypass Vulnerability

CVE-2026-11601 Overview

CVE-2026-11601 is an authorization bypass vulnerability in the WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress. The flaw affects all versions up to and including 3.0.19. The plugin fails to verify user authorization on its email automation endpoints, allowing unauthenticated attackers to read, create, update, clone, and delete email notification flows. Attackers can overwrite default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content sent from the site's legitimate address. The vulnerable endpoints are active by default because Email_Automation_Service_Provider::is_enable() unconditionally returns true, and the plugin ships with five preconfigured email flows on activation.

Critical Impact

Unauthenticated attackers can hijack transactional email flows to send attacker-controlled content from the legitimate site address, enabling phishing and reservation disruption.

Affected Products

• WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress
• All versions through 3.0.19
• Default installations with the bundled Email Notification SDK (themewinter/email-notification-sdk)

Discovery Timeline

• 2026-10-03 - CVE-2026-11601 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-11601

Vulnerability Analysis

The vulnerability is a Missing Authorization issue ([CWE-862]) in the plugin's email automation subsystem. The Email_Automation_Service_Provider::is_enable() method unconditionally returns true, so the related endpoints are reachable on every WPCafe installation without configuration. The underlying FlowAPI methods that create, update, clone, and delete email flows do not perform capability checks or nonce validation on the requesting user. Because the plugin ships with five preconfigured default flows (reservation confirmation, cancellation, admin alerts, and related notifications), an unauthenticated attacker has guaranteed targets to manipulate.

Root Cause

The root cause is the absence of a current_user_can() or equivalent capability check in the FlowAPI handlers at the referenced lines in vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php (lines 58, 138, 156, 282) and in Utils/Helpers.php. The service provider gate (is_enable()) returns true without evaluating caller context, so the registered REST routes accept any request including unauthenticated ones.

Attack Vector

The vulnerability is remotely exploitable over the network without authentication or user interaction. An attacker issues HTTP requests directly to the plugin's email flow endpoints to enumerate existing flows, overwrite their content and recipients, clone them, or delete them entirely. Because outbound mail is sent from the site's legitimate address, phishing messages inherit sender reputation and DMARC/SPF alignment.

No verified public proof-of-concept code is available. For endpoint and parameter details, consult the WPCafe plugin source and the FlowAPI SDK code.

Detection Methods for CVE-2026-11601

Indicators of Compromise

• Unexpected modifications to WPCafe email flow records in the WordPress database, especially changes to subject lines, body templates, or recipient fields.
• Outbound email from the site's legitimate address containing content that does not match the configured reservation workflow.
• Missing or deleted default flows for reservation confirmation, cancellation, and admin alerts after plugin activation.
• REST API requests to WPCafe email automation routes originating from unauthenticated sessions.

Detection Strategies

• Review web server access logs for anonymous POST, PUT, PATCH, or DELETE requests to WPCafe and email notification SDK endpoints.
• Monitor WordPress database tables used by the email automation SDK for unexplained inserts, updates, or deletes.
• Alert on mail queue entries whose template content differs from a known-good baseline of the five default flows.

Monitoring Recommendations

• Enable WordPress audit logging that records REST API calls, including caller identity and route.
• Correlate outbound mail logs with WPCafe flow configuration changes to detect template tampering.
• Track plugin file integrity for wp-cafe and the bundled themewinter/email-notification-sdk directory.

How to Mitigate CVE-2026-11601

Immediate Actions Required

• Upgrade WPCafe to a version later than 3.0.19 once the vendor publishes a fix.
• If an upgrade is not immediately available, deactivate the WPCafe plugin on internet-facing sites that process reservations.
• Audit all existing email flows for tampering and restore known-good templates and recipients.
• Rotate any credentials or links that may have been distributed via the site's mail flows during the exposure window.

Patch Information

Refer to the WordPress plugin changeset log and the Wordfence vulnerability advisory for the fixed version and remediation guidance. Apply the vendor patch across all WordPress installations running WPCafe.

Workarounds

• Block anonymous access to WPCafe email automation REST routes at a web application firewall or reverse proxy.
• Restrict access to /wp-json/ endpoints associated with the plugin to authenticated administrators only.
• Enforce DMARC reporting to detect anomalous outbound mail content that may indicate flow tampering.

# Example nginx rule to block unauthenticated access to WPCafe email automation routes
location ~* /wp-json/.*(wp-?cafe|email-?automation|flow) {
    if ($http_cookie !~* "wordpress_logged_in_") {
        return 403;
    }
}