CVE Intelligence
Analysis AI-assisted

CVE-2026-27071: Arraytics WPCafe (wp-cafe) - Missing Authorization (CWE-862)

WPCafe (wp-cafe) by Arraytics has a missing authorization flaw (CWE-862) reported for versions from n/a through 3.0.7. The CNA scores it CVSS 3.1 9.1 (critical), and the record lists no fixed version. It is not in CISA KEV and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a missing authorization issue (CWE-862) in the WPCafe plugin by Arraytics, identified as wp-cafe. The affected range is reported as from n/a through 3.0.7. The source description states that the flaw relates to incorrectly configured access control security levels. Details are summarized in the NVD entry.

Impact

  • The CNA data in the record assigns a CVSS 3.1 base score of 9.1 (critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.
  • Under that vector, the flaw is reachable over the network, has low complexity, requires no privileges and no user interaction, and has high confidentiality and availability impact with no integrity impact.
  • In practice, a remote party without an account could potentially reach functions that should be restricted. The exact data or actions exposed are not described in the record.

Affected products and versions

  • Product: WPCafe (wp-cafe) by Arraytics.
  • Reported range: from n/a through 3.0.7, inclusive.
  • The record contains no structured lists of affected or fixed versions.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The record includes an EPSS probability of 0.00454 and a percentile of 0.37635, which is a modeled estimate of likelihood and not evidence of activity.

Remediation and mitigation

  • The record does not list a fixed version. Check the vendor and the Patchstack advisory referenced in the record for the current fixed release, and update only to a version the vendor confirms as fixed.
  • Until a fix is applied, reduce exposure: limit access to the WordPress administration area, review which roles can use WPCafe features, and remove plugins that are not needed.
  • Prioritize this item in asset inventories because of the critical base score, while weighing the exposure of each site.

Detection guidance

  • Inventory sites running WPCafe and compare installed versions against the reported range.
  • Review web server and application logs for unexpected requests to WPCafe functions from unauthenticated or low-privilege sessions.
  • Monitor for unexpected changes to plugin-managed content, new administrative accounts, or configuration changes.

Limitations of the available information

  • The record contains no vendor fix details, no affected version list beyond the range, and no description of the specific vulnerable function.
  • The title field in the record is null, so the title used here is derived from the metadata.
  • The EPSS date in the record is later than the publication date and should be verified against the source.
  • Severity values come from the CNA and a second provider with identical values; no independent severity analysis was available.

Frequently asked questions

Is this vulnerability known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which WPCafe versions are affected?

The record reports the range from n/a through 3.0.7. Confirm the exact status against vendor data before acting.

What should be done now?

Check the vendor advisory for a fixed release, restrict access to the administration area, and review which sites run WPCafe.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.