CVE-2026-11818 is an authorization bypass vulnerability (CWE-862) in the WPCafe WordPress plugin up to version 3.0.14. The plugin fails to properly verify user authorization for managing notification flow workflows, relying solely on a wp_rest nonce check that any logged-in user can obtain. Consequently, users with subscriber-level privileges or higher can perform administrative actions such as listing, creating, updating, deleting, cloning, and bulk-deleting notification workflows intended only for administrators.

The vulnerability allows authenticated users with low privileges (subscriber-level) to perform administrative operations on notification workflows, potentially disrupting notification management or causing unauthorized changes. The impact includes limited confidentiality and integrity loss of notification workflows but does not affect availability. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and limited confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to notification workflow management. Avoid granting subscriber-level or higher access to untrusted users. Follow vendor updates for an official fix or temporary mitigation.