CVE-2026-14550: CWE-862 Missing Authorization in WPCafe

The WPCafe plugin prior to version 3.0.18 does not verify proper authorization when processing reservation creation requests via its REST API. Instead, it only checks a publicly available nonce, which is insufficient to restrict access. This flaw enables unauthenticated attackers to submit reservations with any approval status they choose, effectively bypassing the intended administrative moderation workflow.

Unauthenticated users can create reservations with arbitrary approval statuses, potentially allowing unauthorized or malicious reservations to be accepted without administrator review. There is no impact on confidentiality or availability reported, but integrity is affected due to unauthorized modification of reservation approval status.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.0.18, upgrading to version 3.0.18 or later is likely recommended once confirmed by the vendor. Until then, monitor vendor advisories for an official fix or temporary mitigation.