Description

The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator moderation workflow.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-26T06:16:25.007Z",
  "pubdate": "2026-08-26T06:16:25.007Z",
  "executiveSummary": "The WPCafe WordPress plugin contains a critical broken access control vulnerability originating from improper authorization checks within its REST API endpoints.\nThe vulnerability type is categorized as an improper authorization check, which allows unauthenticated remote attackers to interact with the reservation system.\nAffected versions include all instances of WPCafe prior to 3.0.18.\nThe risk implication is significant, as it enables unauthorized modification of reservation data and circumvention of administrative moderation workflows.\nAn attacker can exploit this flaw by submitting HTTP requests to the REST API using only a publicly available nonce, effectively bypassing security barriers intended for administrative verification.\nThe vulnerability requires no elevated privileges or prior authentication, making it trivial to execute by any external party with network access to the target WordPress installation.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient verification logic implemented within the WPCafe REST API endpoints responsible for handling reservation submissions. Specifically, the API lacks a mandatory authorization check to ensure the requesting user possesses the necessary capabilities to perform reservation management actions.\nWhile the plugin attempts to secure its API calls using a nonce, this mechanism is insufficient in this context because the nonce is publicly accessible or predictable. The server-side logic validates the presence and validity of the nonce but fails to verify the session's authorization level or the user's role-based access control (RBAC) permissions before processing the data payload.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies the specific REST API endpoint used by WPCafe to initialize or update reservation requests. By crafting a malicious JSON or form-data payload, the attacker includes the publicly available nonce to satisfy the basic security requirement. Upon submitting the request to the server, the WPCafe component parses the payload without performing a secondary check via 'current_user_can()' or equivalent WordPress capability verification functions.\nBecause the authorization step is missing, the application proceeds to process the reservation object in the database. Crucially, the input validation logic permits the injection of parameters that control the 'approval status' of the reservation. An attacker can set this status to 'approved' or 'confirmed' regardless of the site's configured moderation workflow, which is designed to prevent unauthorized or spam reservations from entering the production queue.\nThe exposure is global, as the REST API is inherently reachable via the web-facing server. Exploitation results in the unauthorized manipulation of reservation records, enabling attackers to flood the system with fraudulent bookings or force the system to display unvetted reservations to administrative staff. This impacts both the integrity of the database and the operational security of the administrator's moderation dashboard. The vulnerability persists across all versions before 3.0.18, representing a complete failure of the expected authorization boundary within the plugin's API architecture."
}