CVE-2026-12981 — HIGH (7.5)

Vulnerability Description

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Related Weaknesses (CWE)

CWE-269

References

https://wpscan.com/vulnerability/79fa8b91-f88e-4249-9f17-9e98e879f6fa/

FAQ

What is CVE-2026-12981?

CVE-2026-12981 is a vulnerability with a CVSS score of 7.5 (HIGH). The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, incl...

How severe is CVE-2026-12981?

CVE-2026-12981 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-12981?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.