CVE-2026-12981
CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset
- State
- Published
- Severity
- 7.5 High
- Published
- Jul 24, 2026
- Updated
- Jul 24, 2026
- Reserved
- Jun 23, 2026
Description
The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
CAFEHAUS APIUnknown |
|
References
- https://wpscan.com/vulnerability/79fa8b91-f88e-4249-9f17-9e98e879f6fa/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.