Is CVE-2026-11818 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11818 being exploited in the wild.

How severe is CVE-2026-11818?

Medium severity, with a CVSS score of 5.4, published 10 July 2026.

Which products and versions are affected?

Themewinter WPCafe up to, and including, 3.0.14.

Is there a fix for CVE-2026-11818?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11818 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11818?

Check whether you run Themewinter WPCafe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11818: Themewinter WPCafe authorization bypass in notification flows

CVE-2026-11818 · Severity: medium · CVSS 5.4 · Published 2026-07-10

WPCafe is a WordPress plugin used by restaurants to manage menus, online orders, and table bookings. A security flaw allows any registered user, such as a customer with a basic account, to modify or delete automated email notification workflows. This could allow unauthorized individuals to disrupt restaurant communications or tamper with how the system handles order notifications.

Technologies: Themewinter WPCafe. Vendors: Themewinter.

Quick answers

Is CVE-2026-11818 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11818 being exploited in the wild.
How severe is CVE-2026-11818?: Medium severity, with a CVSS score of 5.4, published 10 July 2026.
Which products and versions are affected?: Themewinter WPCafe up to, and including, 3.0.14.
Is there a fix for CVE-2026-11818?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11818 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11818?: Check whether you run Themewinter WPCafe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WPCafe plugin for WordPress (versions up to 3.0.14) contains a missing authorization check (CWE-862) in its REST API endpoints for notification flow management. While the endpoints implement a wp_rest nonce check, this nonce is accessible to any logged-in user via the frontend page source. Consequently, authenticated attackers with subscriber-level permissions can bypass intended restrictions to list, create, update, delete, or clone notification workflows. The vulnerability is rooted in the FlowAPI.php and email-notification.php components which fail to verify administrative capabilities before executing sensitive actions.

Affected products

Themewinter (Arraytics) WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System up to, and including, 3.0.14

Timeline

2026-07-10: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.