# CVE-2026-14550: WPCafe authorization bypass in REST API reservation endpoint

Source: https://junglewise.ai/threats/cve-2026-14550-wpcafe-authorization-bypass-in-rest-api-reservation-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-14550 · Severity: medium · CVSS 5.3 · Published 2026-08-26

WPCafe is a WordPress plugin that manages restaurant reservations. An unauthenticated attacker can submit fake reservations and set their status to "confirmed" without administrator approval, bypassing the intended moderation workflow. This could lead to fraudulent reservations being accepted automatically, disrupting restaurant operations and customer experience.

## Quick answers

**Is CVE-2026-14550 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14550 being exploited in the wild.

**How severe is CVE-2026-14550?** Medium severity, with a CVSS score of 5.3, published 26 August 2026.

**Which products and versions are affected?** WPCafe WPCafe before 3.0.18.

**Is there a fix for CVE-2026-14550?** A patch was published on 2026-08-26: Fixed in version 3.0.18 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14550 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-14550?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WPCafe plugin before version 3.0.18 fails to perform proper authorization checks in its REST API endpoint for creating reservations (/wp-json/wpcafe/v2/reservations). The endpoint verifies only a publicly available nonce (extracted from the reservation form page) but does not authenticate the user. An unauthenticated attacker can craft a POST request specifying an arbitrary "status" field (e.g., "confirmed"), bypassing the default "pending" moderation status. The vulnerability is classified as broken access control (CWE-862) and requires no user interaction beyond crafting a malicious API request. The issue is fixed in version 3.0.18.

## Affected products

- WPCafe WPCafe before 3.0.18

## Timeline

- 2026-08-24: disclosed
- 2026-08-26: patched: Fixed in version 3.0.18

## References

- [https://wpscan.com/vulnerability/98d547aa-6060-45d0-9cf6-cc9092dcc7d2/](https://wpscan.com/vulnerability/98d547aa-6060-45d0-9cf6-cc9092dcc7d2/)