The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress has an authorization bypass flaw (CWE‑862). All releases up to and including 3.0.14 allow REST API calls that manage notification workflow configurations without validating the user’s capability. A logged‑in user with subscriber or higher rights can obtain a wp_rest nonce from the front‑end source and use it to invoke the affected endpoints. The attacker can list, create, update, delete, clone, and bulk‑delete notification workflows that are intended to be administered only by administrators, thereby compromising the email notification logic used for orders and bookings.

WordPress sites running the arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin version 3.0.14 or earlier are vulnerable. The flaw applies to any role that can log in, including Subscribers, with no restriction beyond authentication. Administrators already have full control and are not affected by the bypass itself, but the mechanism empowers lower‑privileged users to perform actions normally reserved for administrators.

The CVSS score of 5.4 indicates a moderate severity. An EPSS score of < 1% reflects a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack requires that the user be logged in and that the attacker obtains a wp_rest nonce from the front‑end source, a task that is trivial for an authenticated user. After obtaining the nonce, the attacker can execute REST API requests to modify notification workflows.