WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System <= 3.0.20 - Unauthenticated Sensitive Information Exposure via Product REST API Endpoints
- ID
- WPSEC-2026-0108
- Plugin
- WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System (wp-cafe)
- Affected
- from 3.0.0 before 3.0.21
- Remediation
- Update to 3.0.21 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System on WPSec AttackSurface
- Fix released
- Published
Description
The WPCafe plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 3.0.0 through 3.0.20. This is due to a missing capability check in the permission callbacks of the wpcafe/v2/products REST routes, which granted access to everyone by default. The single-product route (/wp-json/wpcafe/v2/products/<id>) returned internal product fields together with all non-core product meta, including protected underscore-prefixed keys. This makes it possible for unauthenticated attackers to retrieve, for any published product, data that WooCommerce does not show publicly, such as total sales counts, exact stock quantities, purchase notes and private meta stored by other plugins (for example cost or supplier data). The routes are only registered when WooCommerce is active.
References
- https://wpsec.com/vuln/WPSEC-2026-0108/
- https://plugins.svn.wordpress.org/wp-cafe/tags/3.0.21/
- https://wordpress.org/plugins/wp-cafe/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS