CVE-2026-86812

6.5 mediumEPSS 0.3%

Medium (6.5). EPSS 0.3% chance of exploitation in the next 30 days.

The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash, any order.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2026-09-11
Modified: 2026-09-11
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/fe8d76b2-6d57-49cc-9927-5231e1a26a41/

Check your stack JSON