Is CVE-2026-11601 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11601 being exploited in the wild.

How severe is CVE-2026-11601?

Medium severity, with a CVSS score of 5.3, published 3 October 2026.

Which products and versions are affected?

WPCafe up to and including 3.0.19.

Is there a fix for CVE-2026-11601?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11601 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-11601?

Check whether you run WPCafe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11601: WPCafe authorization bypass in email notification management

CVE-2026-11601 · Severity: medium · CVSS 5.3 · Published 2026-10-03

WPCafe is a WordPress plugin that manages restaurant menus, online food ordering, and table reservations. Unauthenticated attackers can modify or delete the plugin's email notification system, allowing them to intercept or replace legitimate reservation confirmations and cancellations with fraudulent messages, or disable email notifications entirely, disrupting restaurant operations and customer communication.

Technologies: WPCafe. Vendors: WPCafe.

Quick answers

Is CVE-2026-11601 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11601 being exploited in the wild.
How severe is CVE-2026-11601?: Medium severity, with a CVSS score of 5.3, published 3 October 2026.
Which products and versions are affected?: WPCafe up to and including 3.0.19.
Is there a fix for CVE-2026-11601?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11601 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-11601?: Check whether you run WPCafe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin fails to verify user authorization when handling email automation endpoints, which are active by default. The Email_Automation_Service_Provider::is_enable() method unconditionally returns true, allowing unauthenticated attackers to read, create, update, and delete email notification flows. The vulnerability affects all versions up to 3.0.19 and enables attackers to overwrite default emails sent from the legitimate site domain.

Affected products

WPCafe WPCafe up to and including 3.0.19

Timeline

2026-10-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.