Executive brief
The WPCafe WordPress plugin provides restaurant/cafe order management capabilities integrated with WooCommerce. A flaw in the plugin's REST API permission checks allows unauthenticated attackers to view sensitive guest order details (names, email addresses, totals) and modify or delete any order without authorization, potentially disrupting business operations and exposing customer information.
Technical details
The vulnerability stems from improper permission callbacks in the food-orders REST API endpoints (/wpcafe/v2/food-orders) that return a response object instead of WP_Error/false/null on authorization failure. WordPress interprets this as a grant, allowing unauthenticated access. Additionally, the mutation and deletion handlers lack per-order ownership validation, enabling attackers to modify or trash any order. The issue affects versions 3.0.10 through 3.0.17 and requires only network access to a vulnerable WordPress installation with WooCommerce enabled; no authentication or user interaction is needed.
Affected products
- WPCafe WPCafe 3.0.10 through 3.0.17
Timeline
- 2026-09-09: disclosed
- 2026-09-11: patched: Fixed in version 3.0.18