CVE-2026-12981

HIGH

CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset

Title source: cna

Description

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.

References (1)

Core 1

Core References

Exploit exploit vdb-entry technical-description

https://wpscan.com/vulnerability/79fa8b91-f88e-4249-9f17-9e98e879f6fa/

Scores

CVSS v3 7.5

EPSS 0.0031

EPSS Percentile 22.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-269

Status published

Products (1)

None/CAFEHAUS API < 1.0.0

Published Jul 24, 2026

Tracked Since Jul 24, 2026