CVE-2026-11601 in WPCafe Plugin
Summary
by MITRE • 10/03/2026
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, clone, and delete email notification flows, including overwriting the default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content sent from the site's legitimate address, or destroying reservation notification flows entirely. The vulnerable endpoints are active by default on every WPCafe installation without any configuration requirement, as the Email_Automation_Service_Provider::is_enable() method unconditionally returns true and the plugin ships with five pre-configured default email flows upon activation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in the WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System for WordPress represents a critical authorization bypass affecting all versions up to 3.0.19. This flaw stems from an insufficient verification of user privileges when handling email notification configurations. Specifically, the plugin fails to enforce proper access controls on endpoints responsible for managing automated email flows. The root cause lies within the Email_Automation_Service_Provider::is_enable() method, which unconditionally returns true regardless of the requesting user's authentication status or role. This design oversight means that any endpoint relying on this check does not actually restrict access based on administrative privileges, thereby exposing sensitive configuration functions to public internet traffic without requiring valid credentials.
From a technical perspective, the absence of capability checks allows unauthenticated attackers to interact with the email automation subsystem directly. The vulnerability enables full control over the five pre-configured default email flows that are active upon plugin installation. Attackers can read existing notification templates, create new malicious ones, update or clone current configurations, and delete critical communication channels entirely. Because these endpoints require no special configuration to be accessible, the attack surface is maximized immediately after a site administrator installs and activates the WPCafe plugin. The lack of nonce verification or capability validation in the REST API handlers further facilitates this unauthorized access, allowing remote code execution via social engineering vectors rather than complex exploitation techniques.
The operational impact of this vulnerability extends beyond simple data theft to significant reputational damage and potential legal liability for affected businesses. By overwriting default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content sent from the site's legitimate domain, attackers can execute sophisticated phishing campaigns or spread malware under the guise of a trusted restaurant brand. This undermines customer trust and may lead to financial fraud if customers are directed to malicious payment pages disguised as official confirmations. Furthermore, the ability to destroy reservation notification flows entirely disrupts business operations by preventing both staff and customers from receiving essential updates regarding bookings, leading to operational chaos and loss of revenue.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting a failure in authorization logic where access control decisions are not properly enforced. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1530 Data from Cloud Storage Objects or more accurately T1539 Steal Web Session Cookie if session hijacking were involved, but primarily it falls under T1486 Data Encrypted for Impact and T1565 Transmitted Data Manipulation. The attacker leverages the compromised email system to manipulate transmitted data, effectively using the organization's own communication channels as a vector for malicious activity. This highlights the critical importance of securing administrative functions even when they appear benign or automated.
Mitigation strategies must prioritize immediate patching and defensive configuration changes until updates are applied by all users. Site administrators should update the WPCafe plugin to version 3.0.20 or later, where proper authorization checks have been implemented in the Email_Automation_Service_Provider class. For sites unable to upgrade immediately, it is advisable to restrict access to WordPress admin endpoints via IP whitelisting if possible and to monitor server logs for unusual POST requests targeting email automation REST API paths. Additionally, implementing a Web Application Firewall with rules that detect unauthorized attempts to modify plugin settings can provide an additional layer of defense against exploitation attempts while the underlying code vulnerability remains unpatched in older installations.