CVE-2026-12981 is a high-severity vulnerability in the CAFEHAUS API WordPress plugin (versions up to and including 1.0.0). The plugin does not enforce any authentication or authorization checks on its password update functionality. As a result, an unauthenticated attacker can set new passwords for any user account, including those with administrative privileges, leading to complete account compromise. The vulnerability is categorized under CWE-269 (Improper Privilege Management). No official patch or remediation guidance is currently available from the vendor, and no known exploits have been reported in the wild.

An attacker can fully take over any user account on a WordPress site using the vulnerable CAFEHAUS API plugin by changing passwords without authentication. This includes administrator accounts, which can lead to complete site compromise and loss of control over the affected WordPress installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict or disable the use of the CAFEHAUS API plugin, especially its password update functionality, to prevent unauthorized access. Monitor for updates from the vendor and apply any official patches promptly once available.