Authorization Bypass in WPCafe Plugin for WordPress
CVE-2026-14550
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14550?
The WPCafe WordPress plugin prior to version 3.0.18 exhibits a significant vulnerability where it fails to implement essential authorization checks during the reservation process via its REST API. This oversight allows unauthenticated users to create reservations without proper validation, using only a publicly available nonce. As a result, users can manipulate the approval status of reservations, effectively bypassing the necessary administrative oversight and moderation that should normally govern these submissions.
Affected Version(s)
WPCafe 0 < 3.0.18
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.