# CVE-2026-11818: Themewinter WPCafe authorization bypass in notification flows

Source: https://junglewise.ai/threats/cve-2026-11818-themewinter-wpcafe-authorization-bypass-in-notification-flows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-11818 · Severity: medium · CVSS 5.4 · Published 2026-07-10

WPCafe is a WordPress plugin used by restaurants to manage menus, online orders, and table bookings. A security flaw allows any registered user, such as a customer with a basic account, to modify or delete automated email notification workflows. This could allow unauthorized individuals to disrupt restaurant communications or tamper with how the system handles order notifications.

Technologies: [Themewinter WPCafe](https://junglewise.ai/threats/technologies/wpcafe). Vendors: [Themewinter](https://junglewise.ai/threats/vendors/themewinter).

## Quick answers

**Is CVE-2026-11818 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11818 being exploited in the wild.

**How severe is CVE-2026-11818?** Medium severity, with a CVSS score of 5.4, published 10 July 2026.

**Which products and versions are affected?** Themewinter WPCafe up to, and including, 3.0.14.

**Is there a fix for CVE-2026-11818?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11818 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11818?** Check whether you run Themewinter WPCafe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WPCafe plugin for WordPress (versions up to 3.0.14) contains a missing authorization check (CWE-862) in its REST API endpoints for notification flow management. While the endpoints implement a wp_rest nonce check, this nonce is accessible to any logged-in user via the frontend page source. Consequently, authenticated attackers with subscriber-level permissions can bypass intended restrictions to list, create, update, delete, or clone notification workflows. The vulnerability is rooted in the FlowAPI.php and email-notification.php components which fail to verify administrative capabilities before executing sensitive actions.

## Affected products

- Themewinter (Arraytics) WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System up to, and including, 3.0.14

## Timeline

- 2026-07-10: advisory: NVD publication date

## References

- [https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.13/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php](https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.13/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php)
- [https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.13/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php](https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.13/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php)
- [https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.13/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php](https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.13/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php)
- [https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.13/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php](https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.13/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php)
- [https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.13/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php](https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.13/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php)
- [https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.13/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php](https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.13/vendor/themewinter/email-notification-sdk/src/Flow/FlowAPI.php)
- [https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.15/core/email-automation/Service/email-notification.php](https://plugins.trac.wordpress.org/browser/wp-cafe/tags/3.0.15/core/email-automation/Service/email-notification.php)

## Related threats

- [Arraytics WPCafe broken access control](https://junglewise.ai/threats/cve-2026-57622-arraytics-wpcafe-broken-access-control)