SEPTEMBER 20, 2026
Live Feed
Back to database
Case File

CVE-2026-12981

HIGH · CVSS 7.5 EPSS 0.30%

Source: NVD + CISA KEV + EPSS · Published 2026-07-24 · Last synced 2026-08-23

CyberRota Analysis

AI-Generated

The CAFEHAUS API WordPress plugin versions up to 1.0.0 are vulnerable due to a lack of authentication and authorization mechanisms when updating user passwords. This flaw allows unauthenticated attackers to reset passwords for any user, including administrators, potentially leading to full account takeover. WordPress site administrators and users of this plugin should prioritize immediate updates to mitigate the risk of unauthorized access.

CVE
CVE-2026-12981
Severity
HIGH
CVSS
7.5
EPSS
0.30%
WordPress

Original NVD Description

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.