Authorization Bypass in WPCafe Restaurant Menu Plugin for WordPress

CVE-2026-11818

What is CVE-2026-11818?

The WPCafe plugin for WordPress contains a vulnerability that allows authenticated users with subscriber-level access and above to bypass authorization controls. This issue enables unauthorized actions such as listing, creating, updating, deleting, cloning, and bulk deleting workflows intended for administrative management. The vulnerability arises from insufficient verification of user permissions and relies solely on a nonce check that is easily accessible by any logged-in user through the frontend page source. Proper validation should be implemented to ensure that only authorized users can perform these actions.

References