The WPCafe WordPress plugin fails to perform an authorization check when a reservation is created via its REST API. The API only verifies a public nonce, so users who are not logged in can submit reservations with any approval status, effectively allowing them to approve or submit reservations without administrator review. This flaw can be used to inject spam or malicious reservations that normally would be rejected or moderated, leading to potential data integrity and availability issues.

The vulnerability affects any WordPress site that installs the WPCafe plugin version earlier than 3.0.18. Users running such a plugin are capable of sending unauthenticated REST API requests to create reservations, as the patch is only available in version 3.0.18 and later.

Because the vulnerability is accessible through the publicly exposed REST API, any internet‑connected attacker can exploit it without prior authentication. While no EPSS score or CVSS score is provided, the lack of an authentication layer coupled with the option to set approval flags indicates a high potential impact. The flaw is not listed in the CISA KEV catalog, but its exploitability relies on simple HTTP requests and therefore represents a significant risk to sites that rely on the plugin for reservation management.