CVE-2026-14550: WPCafe < 3.0.18 - Unauthenticated Reservation Approval Bypass via Missing Authorization
The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator moderation workflow.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user who can access the affected plugin's REST API can submit a reservation. Exploitation requires only the publicly available nonce checked by the endpoint; no authenticated WordPress account is required.
What is the impact on reservation handling?
An attacker can create reservations with an arbitrary approval status, bypassing the administrator moderation workflow. This can result in reservations being submitted as approved without administrator review.
Which versions are affected?
WPCafe versions before 3.0.18 are affected. Updating to version 3.0.18 or later addresses the described missing authorization check.