CVE-2026-11818 is an authorization bypass vulnerability (CWE-862) in the WPCafe WordPress plugin up to version 3.0.14. The plugin fails to properly verify user authorization for managing notification flow workflows. Authenticated users with subscriber-level privileges can exploit this flaw to perform administrative actions such as listing, creating, updating, deleting, cloning, and bulk deleting workflows. The only check in place is a wp_rest nonce, which is obtainable by any logged-in user, making the authorization bypass possible.

The vulnerability allows authenticated users with low-level privileges (subscriber and above) to perform administrative operations on notification workflows that should be restricted to administrators. This can lead to unauthorized modification or deletion of notification workflows, potentially disrupting notification functionality or enabling further malicious actions within the WordPress environment. The confidentiality and integrity of notification workflows are impacted, but availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to notification workflows. Avoid granting subscriber or higher privileges to untrusted users. Follow vendor updates closely for a security patch addressing this authorization bypass.