Junglewise Threat Intelligence

CVE-2026-11818: Themewinter WPCafe authorization bypass in notification flows

CVE-2026-11818 · Severity: medium · CVSS 5.4 · Published 2026-07-10

Technologies: Themewinter WPCafe. Vendors: Themewinter.

Executive brief

WPCafe is a WordPress plugin used by restaurants to manage menus, online orders, and table bookings. A security flaw allows any registered user, such as a customer with a basic account, to modify or delete automated email notification workflows. This could allow unauthorized individuals to disrupt restaurant communications or tamper with how the system handles order notifications.

Technical details

The WPCafe plugin for WordPress (versions up to 3.0.14) contains a missing authorization check (CWE-862) in its REST API endpoints for notification flow management. While the endpoints implement a wp_rest nonce check, this nonce is accessible to any logged-in user via the frontend page source. Consequently, authenticated attackers with subscriber-level permissions can bypass intended restrictions to list, create, update, delete, or clone notification workflows. The vulnerability is rooted in the FlowAPI.php and email-notification.php components which fail to verify administrative capabilities before executing sensitive actions.

Affected products

  • Themewinter (Arraytics) WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System up to, and including, 3.0.14

Timeline

  • 2026-07-10: advisory: NVD publication date

References

Related threats