Description
The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.
Published: 2026-07-24
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The CAFEHAUS API WordPress plugin up to version 1.0.0 lacks authentication or authorization checks when updating user passwords, allowing any visitor to set the password for any user, including administrators, leading to full account compromise as described in the CVE. This is a credential management flaw identified as CWE‑269.

Affected Systems

WordPress installations that have the CAFEHAUS API plugin installed with a version equal to or earlier than 1.0.0 are affected. The vendor/product is listed in the CNA data as Unknown:CAFEHAUS API.

Risk and Exploitability

With a CVSS score of 7.5 the vulnerability is rated high severity. Its EPSS score of less than 1 percent indicates a low current likelihood of exploitation, and it is not present in CISA’s KEV catalog. The likely attack vector is a direct HTTP request to the plugin’s password reset endpoint, which does not require any authentication or authorization, allowing an unauthenticated attacker to trigger the reset and take over any account.

Generated by OpenCVE AI on August 3, 2026 at 20:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the CAFEHAUS API plugin to a version newer than 1.0.0.
  • If no newer version is available, uninstall the plugin to eliminate the vulnerability.
  • Restrict access to the password reset endpoint by implementing firewall rules or .htaccess restrictions that only allow authenticated users.
  • Monitor server logs for unexpected password reset attempts and review user account activity for signs of compromise.

Generated by OpenCVE AI on August 3, 2026 at 20:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Cafehaus
Cafehaus cafehaus Api
Wordpress
Wordpress wordpress
Vendors & Products Cafehaus
Cafehaus cafehaus Api
Wordpress
Wordpress wordpress

Fri, 24 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 24 Jul 2026 06:45:00 +0000

Type Values Removed Values Added
Description The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.
Title CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset
References

Subscriptions

Cafehaus Cafehaus Api
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-07-24T19:40:55.809Z

Reserved: 2026-06-23T11:34:58.155Z

Link: CVE-2026-12981

cve-icon Vulnrichment

Updated: 2026-07-24T19:40:41.049Z

cve-icon NVD

Status : Deferred

Published: 2026-07-24T07:16:32.880

Modified: 2026-07-24T20:48:39.923

Link: CVE-2026-12981

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T20:45:03Z

Weaknesses
  • CWE-269

    Improper Privilege Management