Executive brief
WPCafe is a WordPress plugin that manages restaurant reservations. An unauthenticated attacker can submit fake reservations and set their status to "confirmed" without administrator approval, bypassing the intended moderation workflow. This could lead to fraudulent reservations being accepted automatically, disrupting restaurant operations and customer experience.
Technical details
The WPCafe plugin before version 3.0.18 fails to perform proper authorization checks in its REST API endpoint for creating reservations (/wp-json/wpcafe/v2/reservations). The endpoint verifies only a publicly available nonce (extracted from the reservation form page) but does not authenticate the user. An unauthenticated attacker can craft a POST request specifying an arbitrary "status" field (e.g., "confirmed"), bypassing the default "pending" moderation status. The vulnerability is classified as broken access control (CWE-862) and requires no user interaction beyond crafting a malicious API request. The issue is fixed in version 3.0.18.
Affected products
- WPCafe WPCafe before 3.0.18
Timeline
- 2026-08-24: disclosed
- 2026-08-26: patched: Fixed in version 3.0.18