Description

The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash, any order.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-11T07:16:47.737Z",
  "pubdate": "2026-09-11T07:16:47.737Z",
  "executiveSummary": "The WPCafe WordPress plugin, in versions prior to 3.0.18, contains a critical security vulnerability involving improper access control within its REST API implementation. The flaw resides in the permission callbacks of specific order-management endpoints, which return an incorrect data type upon authorization failure. This behavior erroneously allows unauthenticated users to bypass security checks that should restrict access to sensitive order data. The vulnerability permits unauthorized actors to perform administrative actions, including the disclosure of guest order information, modification of order statuses, and the ability to move orders to the trash. This represents a significant risk to data confidentiality and integrity, as it grants unauthenticated attackers the ability to manipulate order workflows and access personally identifiable information (PII) without requiring valid credentials or elevated privileges. The vulnerability is exploitable remotely over the network, necessitating an immediate update to version 3.0.18 or higher to mitigate the risk of unauthorized data access and administrative manipulation of the WooCommerce order database.",
  "technicalDetails": "The vulnerability originates from a flawed implementation of permission callback functions within the WPCafe REST API. In the WordPress REST API framework, a permission callback is responsible for validating whether the current request is authorized to interact with a specific endpoint. These functions are expected to return a boolean 'true' if the request is permitted, or a 'WP_Error' object if the request is unauthorized. The WPCafe plugin fails to adhere to this standard, returning an incorrect data type when authentication checks fail.\nSpecifically, the affected order-management endpoints do not properly handle the failure condition. Because the callback does not return a formal 'WP_Error' object indicating a lack of permission, the REST API controller fails to terminate the request lifecycle as intended. Instead, it proceeds to execute the handler logic, effectively treating the unauthenticated request as authorized. This logic flaw exposes the underlying order management functions to the public internet.\nThe attack flow involves an unauthenticated attacker sending crafted HTTP requests (typically GET, POST, or DELETE) to the vulnerable WPCafe REST API endpoints. Since the permission check is bypassed, the attacker can supply parameters, such as specific order IDs, to query sensitive information related to guest orders. Furthermore, the attacker can invoke methods that modify the state of an order. For instance, by targeting endpoints responsible for order updates, an attacker can transition an order from 'Processing' to 'Completed' or 'Cancelled', or delete orders entirely by invoking the trash functionality. The attack does not require any prior authentication, privilege escalation, or social engineering; the request is processed in the context of the server's backend, leading to complete loss of confidentiality and integrity regarding order management. Post-exploitation, the attacker gains the ability to exfiltrate order history and manipulate business operations, potentially impacting customer trust and site data integrity."
}