Medium · 5.4 CVE-2026-124408 EUVD-2026-123381GHSA-f8q2-rm2h-8x5x

WordPress WPCafe plugin <= 3.0.22 - Broken Access Control vulnerability

Published Nov 11, 2026 · Updated Nov 12, 2026 · Assigned by Patchstack

Description

Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through 3.0.22.

Affected products

Vendor	Product	Affected	Fixed
Arraytics	WPCafe	≤ 3.0.22	—

References

https://patchstack.com/database/wordpress/plugin/wp-cafe/vulnerability/wordpress-wpcafe-plugin-3-0-22-broken-access-control-vulnerability?_s_id=cve vdb-entry