The WPCafe WordPress plugin does not perform an authorization check when a reservation is created via its REST API. It only verifies a publicly available nonce, so unauthenticated users can submit reservations with arbitrary approval status, bypassing the administrator moderation workflow. This flaw can be exploited to inject spam or malicious reservations that would otherwise be rejected, impacting data integrity and potentially availability.

The vulnerability affects any WordPress site that installs the WPCafe plugin before version 3.0.18. Users running such a plugin can send unauthenticated REST API requests to create reservations, and the flaw is only fixed in version 3.0.18 and later.

The flaw is exposed through a publicly reachable REST endpoint, so any internet‑connected attacker can exploit it without prior authentication. The CVSS score of 5.3 and an EPSS score below 1% indicate medium severity but a low probability of exploitation. Although the vulnerability is not listed in CISA’s KEV catalog, the ability to set approval flags allows malicious actors to alter reservation data, potentially flooding the system or bypassing moderation.