CVE-2026-66585: CWE-201 Insertion of Sensitive Information Into Sent Data in WPCafe WP Cafe Pro

This vulnerability in WP Cafe Pro (before version 3.0.15) allows unauthenticated attackers to access sensitive information due to improper handling of data sent by the application. The issue is classified as CWE-201, indicating that sensitive information is inserted into data sent out, potentially exposing it to unauthorized parties. The CVSS v3.1 base score is 7.5, reflecting a high impact on confidentiality with no required privileges or user interaction for exploitation. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation results in high confidentiality impact through exposure of sensitive data without requiring authentication. Integrity and availability are not affected. This could lead to leakage of private information managed by WP Cafe Pro, potentially compromising user privacy or business data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, consider restricting access to the WP Cafe Pro interface and monitoring for unusual data exposure. Avoid exposing the affected versions publicly if possible.