CVE-2026-11601: CWE-862 Missing Authorization in arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, clone, and delete email notification flows, including overwriting the default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content sent from the site's legitimate address, or destroying reservation notification flows entirely. The vulnerable endpoints are active by default on every WPCafe installation without any configuration requirement, as the Email_Automation_Service_Provider::is_enable() method unconditionally returns true and the plugin ships with five pre-configured default email flows upon activation.
AI Analysis
Technical Summary
CVE-2026-11601 is an authorization bypass vulnerability (CWE-862) in the WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System WordPress plugin. Versions up to and including 3.0.19 do not properly verify user authorization for actions on email notification flows. The Email_Automation_Service_Provider::is_enable() method always returns true, activating vulnerable endpoints by default. This allows unauthenticated attackers to fully manipulate email flows, potentially sending attacker-controlled emails from the site or disrupting reservation notifications.
Potential Impact
An unauthenticated attacker can read and modify email notification flows, including reservation confirmations, cancellations, and admin alerts. This can lead to unauthorized email content being sent from the legitimate site address, potentially facilitating phishing or social engineering attacks. Additionally, attackers can delete notification flows, disrupting normal reservation communications. There is no direct confidentiality impact, but integrity of email notifications is compromised. Availability impact is limited to deletion of notification flows.
Mitigation Recommendations
No patch or official fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's endpoints if possible and monitor for suspicious activity related to email notifications. Avoid relying solely on default configurations for email flows.
CVE-2026-11601: CWE-862 Missing Authorization in arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
Description
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, clone, and delete email notification flows, including overwriting the default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content sent from the site's legitimate address, or destroying reservation notification flows entirely. The vulnerable endpoints are active by default on every WPCafe installation without any configuration requirement, as the Email_Automation_Service_Provider::is_enable() method unconditionally returns true and the plugin ships with five pre-configured default email flows upon activation.
CVSS v3.1
Score 5.3medium
Affected software
arraytics
WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-11601 is an authorization bypass vulnerability (CWE-862) in the WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System WordPress plugin. Versions up to and including 3.0.19 do not properly verify user authorization for actions on email notification flows. The Email_Automation_Service_Provider::is_enable() method always returns true, activating vulnerable endpoints by default. This allows unauthenticated attackers to fully manipulate email flows, potentially sending attacker-controlled emails from the site or disrupting reservation notifications.
Potential Impact
An unauthenticated attacker can read and modify email notification flows, including reservation confirmations, cancellations, and admin alerts. This can lead to unauthorized email content being sent from the legitimate site address, potentially facilitating phishing or social engineering attacks. Additionally, attackers can delete notification flows, disrupting normal reservation communications. There is no direct confidentiality impact, but integrity of email notifications is compromised. Availability impact is limited to deletion of notification flows.
Mitigation Recommendations
No patch or official fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's endpoints if possible and monitor for suspicious activity related to email notifications. Avoid relying solely on default configurations for email flows.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-06-08T15:07:27.415Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac0abd5a43b0b3b89a7e7c8
Added to database: 10/03/2026, 07:16:37 UTC
Last enriched: 10/03/2026, 07:31:55 UTC
Last updated: 10/04/2026, 02:46:03 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.