CVE-2026-124408: WordPress WPCafe plugin <= 3.0.22 - Broken Access Control vulnerability
Published Nov 11, 2026
·Updated
Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through 3.0.22.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPCafe pluginto a version that resolves this vulnerability.Fixed in 3.0.23
Event History
Nov 11, 2026
CVE Published
via MITRE·11:48 AM
Data Sourced
via MITRE·11:48 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·12:19 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need?
The CVSS vector indicates that an attacker needs low privileges and does not require user interaction. The attack can be performed remotely over the network.
2
What is the expected impact if exploited?
The reported impact is limited loss of confidentiality and integrity. No availability impact is indicated.
3
Which installations should be treated as affected?
WPCafe versions through 3.0.22 are listed as affected. The available data does not identify a fixed version or a configuration-based exception.