WordPress Plugin Vulnerabilities

CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset

Description

The plugin does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.

Proof of Concept

Affects Plugins

Plugin icon
cafe-api
No known fix

References

CVE
CVE-2026-12981

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
moonge
Submitter
moonge
Verified
Yes
WPVDB ID
79fa8b91-f88e-4249-9f17-9e98e879f6fa

Timeline

Publicly Published
2026-07-03 (about 2 months ago)
Added
2026-07-03 (about 2 months ago)
Last Updated
2026-09-02 (about 1 day ago)

Other

Published
Title
Published
2026-07-23
Title
WPify Woo < 5.4.17 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint
Published
2024-12-13
Title
Frontend Admin by DynamiApps < 3.25.1 - Unauthenticated Privilege Escalation
Published
2023-08-08
Title
Real Estate Manager <= 7.2 - Subscriber+ Privilege Escalation
Published
2019-08-23
Title
Bold Page Builder < 2.3.2 - Missing Access Controls
Published
2026-07-22
Title
MDJM Event Management < 1.7.8.5 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers