CVE-2026-116015.3MediumCWE-862

CVE-2026-11601: WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete

arraytics · WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System

Affected: arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.4%probability of exploitation in the next 30 days

29th percentile

050100

Higher than 29% of scored CVEs

5.3MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, clone, and delete email notification flows, including overwriting the default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content sent from the site's legitimate address, or destroying reservation notification flows entirely. The vulnerable endpoints are active by default on every WPCafe installation without any configuration requirement, as the Email_Automation_Service_Provider::is_enable() method unconditionally returns true and the plugin ships with five pre-configured default email flows upon activation.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

arraytics · WPCafe – Restaurant Menu, Online Food Ordering & Table Booking Systemup to and including 3.0.19

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Missing Authorization · Access Control
Vendor: arraytics
Published: October 2026
Band: Unlikely (under 1%), October 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-11601 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.

References

4 more references are in the CVE record.