CVE-2026-86812: WPCafe WordPress Information Disclosure

CVE-2026-86812 Overview

CVE-2026-86812 is a broken access control vulnerability [CWE-284] in the WPCafe WordPress plugin versions before 3.0.18. The plugin exposes a set of order-management REST endpoints whose permission callbacks return an incorrect type on failure. WordPress interprets the non-boolean return value as an authorization pass, allowing unauthenticated attackers to reach protected endpoints. Attackers can disclose guest order information, modify order status, or move orders to trash without authentication.

Critical Impact

Unauthenticated attackers can read guest order data and tamper with order state across any WPCafe deployment running a vulnerable version, undermining order integrity and customer data confidentiality.

Affected Products

• WPCafe WordPress plugin versions prior to 3.0.18
• WordPress sites using WPCafe for restaurant and cafe order management
• Guest checkout order records managed through WPCafe REST endpoints

Discovery Timeline

• 2026-09-11 - CVE-2026-86812 published to the National Vulnerability Database (NVD)
• 2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-86812

Vulnerability Analysis

The vulnerability resides in the permission callbacks registered for WPCafe order-management REST routes. In the WordPress REST API, permission callbacks must return a strict boolean or a WP_Error object. When a callback returns a non-boolean value such as an integer, string, or truthy object on the failure path, WordPress treats the response as authorized.

The WPCafe callbacks return an incorrect type when the caller lacks the required capability. The REST controller therefore invokes the underlying endpoint handler for unauthenticated requests. Attackers reach handlers that list guest orders, update order status, and trash orders without providing any credentials.

The issue is classified as improper access control [CWE-284]. It is a logic flaw in authorization enforcement rather than a memory-safety or injection defect. The attack requires no user interaction and is exploitable over the network against any reachable WordPress site running the plugin.

Root Cause

The root cause is an incorrect return type from the REST permission callback functions. WordPress' rest_authorization_required_code() gating only blocks requests when the callback returns false or a WP_Error. Any other truthy value bypasses authorization checks, exposing the order-management handlers to unauthenticated callers.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to the vulnerable WPCafe REST endpoints under /wp-json/. The permission callback returns a truthy non-boolean value, WordPress permits the request, and the endpoint handler executes. The attacker can enumerate guest order records, change the status of any order, or move orders to the trash. Full technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-86812

Indicators of Compromise

• Unauthenticated HTTP requests to WPCafe REST routes under /wp-json/ targeting order-management endpoints
• Unexpected changes to order status fields or orders appearing in the trashed state without an authenticated admin action
• Access log entries for order-related REST endpoints originating from IP addresses that have never authenticated to the site

Detection Strategies

• Inspect WordPress access logs for GET, POST, or DELETE requests to WPCafe order REST routes without a valid Cookie or X-WP-Nonce header
• Correlate REST endpoint access with order state transitions in the WPCafe database tables to identify unauthorized modifications
• Alert on bursts of REST requests to /wp-json/ paths containing WPCafe order identifiers from a single source address

Monitoring Recommendations

• Enable verbose REST API request logging on the WordPress host and forward logs to a centralized analytics platform
• Track the WPCafe plugin version across managed WordPress deployments and flag any instance below 3.0.18
• Monitor the WordPress postmeta and order tables for status changes that lack a corresponding authenticated administrator session

How to Mitigate CVE-2026-86812

Immediate Actions Required

• Upgrade the WPCafe plugin to version 3.0.18 or later on every affected WordPress site
• Audit recent order records for unauthorized status changes, trashed entries, and disclosure of guest customer data
• Rotate any API keys or tokens tied to the site if evidence of endpoint abuse is present

Patch Information

The vendor addressed the flaw in WPCafe 3.0.18 by correcting the REST permission callbacks to return proper boolean or WP_Error values on authorization failure. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

• Restrict access to /wp-json/ order-management routes at the web server or WAF layer until the plugin is upgraded
• Temporarily deactivate the WPCafe plugin on production sites that cannot be patched immediately
• Block unauthenticated requests to WPCafe REST endpoints using an allowlist of trusted IP addresses for administrative traffic

# Example nginx rule to block unauthenticated access to WPCafe REST routes
location ~ ^/wp-json/wpcafe/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}