Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-12981

CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown CAFEHAUS API

Default version status: unknown

  • 0 to ≤ 1.0.0affected

References