CVE-2026-11818: WPCafe Auth Bypass Vulnerability

CVE-2026-11818 Overview

CVE-2026-11818 is an authorization bypass vulnerability in the WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress. The flaw affects all versions up to and including 3.0.14. The plugin fails to verify that a requesting user holds administrative privileges before executing sensitive notification flow operations. Authenticated attackers with subscriber-level access or above can list, create, update, delete, clone, and bulk-delete notification flow workflows. The endpoints rely solely on a wp_rest nonce check, which any logged-in user can obtain from frontend page source. The issue is classified as Missing Authorization [CWE-862].

Critical Impact
Any authenticated WordPress user, including low-privilege subscribers, can manipulate email notification workflows intended for administrators, enabling tampering with restaurant order and booking communications.

Affected Products

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress
All versions up to and including 3.0.14
Fixed in version 3.0.15

Discovery Timeline

2026-07-10 - CVE-2026-11818 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-11818

Vulnerability Analysis

The vulnerability resides in the notification flow REST API endpoints exposed by the WPCafe plugin. These endpoints are implemented in the bundled email-notification-sdk under vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php. The plugin registers routes for listing, creating, updating, deleting, cloning, and bulk-deleting notification flow workflows. Each route uses a permission callback that only validates a wp_rest nonce. It does not call current_user_can() with an administrative capability such as manage_options. Because WordPress issues valid wp_rest nonces to any authenticated session, a subscriber can enumerate the nonce from any frontend page and invoke the endpoints directly.

Root Cause

The root cause is missing capability enforcement in the REST route permission callbacks [CWE-862]. Nonces in WordPress protect against cross-site request forgery. They are not an authorization mechanism. Treating the wp_rest nonce as a proxy for administrator status collapses authentication and authorization into a single check. The corrected implementation in version 3.0.15, located in core/email-automation/Service/email-notification.php, adds proper capability validation before executing flow management operations.

Attack Vector

An attacker registers or uses any subscriber-level account on the target WordPress site. The attacker loads any authenticated frontend page and extracts the wp_rest nonce from the page source or the wpApiSettings JavaScript object. The attacker then issues HTTP requests to the notification flow REST endpoints with the harvested nonce. This allows arbitrary creation, modification, cloning, and deletion of notification flows that control transactional emails for orders and bookings.

Detection Methods for CVE-2026-11818

Indicators of Compromise

REST API requests to notification flow endpoints under the WPCafe or themewinter/email-notification-sdk namespace originating from non-administrator user sessions.
Unexpected creation, cloning, or bulk deletion of notification flow workflow entries in the plugin's database tables.
Modified email notification templates or trigger conditions without a corresponding administrator audit log entry.

Detection Strategies

Enable WordPress REST API request logging and review POST, PUT, and DELETE requests to WPCafe flow routes correlated with the requesting user role.
Alert when users with roles below administrator successfully invoke flow management endpoints.
Compare current notification flow configurations against a known-good baseline to identify unauthorized changes.

Monitoring Recommendations

Forward web server and WordPress audit logs to a centralized SIEM for role-based request analysis.
Monitor for enumeration of wpApiSettings nonces followed by rapid REST API calls from the same session.
Track subscriber account creation spikes on sites running vulnerable WPCafe versions.

How to Mitigate CVE-2026-11818

Immediate Actions Required

Update the WPCafe plugin to version 3.0.15 or later on all WordPress installations.
Audit existing notification flow workflows for unauthorized additions, modifications, or deletions.
Review WordPress user accounts and remove unused or unexpected subscriber-level registrations.

Patch Information

Themewinter addressed the issue in WPCafe version 3.0.15. The fix relocates flow management logic into core/email-automation/Service/email-notification.php and adds administrative capability checks in the REST permission callbacks. Reference the Wordfence Vulnerability Report and the patched code in tag 3.0.15 for verification details.

Workarounds

Disable user registration on WordPress sites running vulnerable WPCafe versions until the patch is applied.
Restrict access to the WPCafe REST API namespaces at the web application firewall for non-administrator sessions.
Temporarily deactivate the WPCafe plugin if patching cannot be performed immediately and notification workflows are not business critical.

bash

# Configuration example: update WPCafe via WP-CLI
wp plugin update wp-cafe --version=3.0.15
wp plugin get wp-cafe --field=version