CVE-2026-11818: arraytics wpcafe – restaurant menu, online food ordering & table booking system Missing Authorization
Vulnerability summary
CVE-2026-11818 is a medium (CVSS 5.4) Missing Authorization vulnerability in arraytics wpcafe – restaurant menu, online food ordering & table booking system. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.1% of scored vulnerabilities. Fixed in 3.0.15.
Timeline
- 10-07-2026PublishedVulnerability first disclosed.
- 10-07-2026Last modifiedVulnerability information updated.
Description
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to list, create, update, delete, clone, and bulk-delete notification flow workflows that are intended to be managed only by administrators. The only protection on these endpoints is a wp_rest nonce check, which is obtainable by any logged-in user from the frontend page source.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- wordfenceSource5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
0.00 pp
From 0.41% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Arraytics1 product
Wordpress1 product
- wp-cafe≤ 3.0.14 (fixed in 3.0.15)
2 vendors · 2 products