CVE-2026-27071

CVEs › CVE-2026-27071

Description

Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7.

Overview

State: PUBLISHED
Assigner (CNA): Patchstack
CVSS severity: CRITICAL
CVSS score: 9.1 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Effective score: 9.1 / 10 CRITICAL source: CNA overview
CWE(s): CWE-862
Reserved: 2026-02-17
Published: 2026-03-25 17:14 UTC
Last updated: 2026-04-29 11:51 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/27xxx/CVE-2026-27071.json
Linked Threat: CVE-2026-27071 — WPCafe – Restaurant Menu, Online Food Ordering and Reservation Booking Solution <= 3.0.7 - Missing Authorization

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-03-25 17:16:54 UTC
NVD last modified: 2026-04-29 10:16:55 UTC
NVD CVSS v3.1: 9.1 / 10 CRITICAL source: audit@patchstack.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Exploitability subscore: 3.9 / 10
Impact subscore: 5.2 / 10
EPSS score: 0.0006 (probability of exploitation in next 30 days)
EPSS percentile: 19.43% vs all CVEs — higher = more likely to be exploited, as of 2026-05-25

NVD / KEV / EPSS data refreshed 2026-05-25 18:01 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-15773
Assigner: Patchstack
Published: Mar 25, 2026, 4:14:54 PM
Updated: Apr 29, 2026, 9:51:57 AM
EUVD base score (CVSS 3.1): 9.1 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EUVD-reported EPSS: 0.0600
Vendors: arraytics
Products: WPCafe (0 ≤3.0.7)

WPCafe (n/a ≤≤ 3.0.7)

ENISA description: Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7.

EUVD references (1)

https://patchstack.com/database/Wordpress/Plugin/wp-cafe/vulnerability/wordpress-wpcafe-plugin-3-0-6-broken-access-control-vulnerability?_s_id=cve

Affected products (1)

Vendor	Product	Versions	Platforms
Arraytics	WPCafe	`0` (affected)	—

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://patchstack.com/database/Wordpress/Plugin/wp-cafe/vulnerability/wordpress-wpcafe-plugin-3-0-6-broken-access-control-vulnerability?_s_id=cve vdb-entry

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

http://cwe.mitre.org/data/definitions/862.html rapid7:cwe.mitre.org
https://attackerkb.com/topics/CVE-2026-27071 rapid7:attackerkb.com
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-15773 rapid7:euvd.enisa.europa.eu
https://www.cve.org/CVERecord?id=CVE-2026-27071 rapid7:www.cve.org
https://www.wordfence.com/threat-intel/vulnerabilities/id/3779cf95-9dfd-492b-b3a2-68dce3bb342d?source=api-prod rapid7:www.wordfence.com

NVD-tagged references (1)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://patchstack.com/database/Wordpress/Plugin/wp-cafe/vulnerability/wordpress-wpcafe-plugin-3-0-6-broken-access-control-vulnerability?_s_id=cve audit@patchstack.com

Indicators (2)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
domain	`levels.this`	no local data	2026-05-18 21:18 UTC
cve	`CVE-2026-27071`	no local data	2026-06-05 13:29 UTC

Remediations (18)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Wordfence remediation: WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System

Wordfence

Update to version 3.0.8, or a newer patched version

2026-06-05 13:29 UTC
XD Investments LLC Recalls Better Weather Fix Elixir Products Due to ...

web:www.fda.gov

XD Investments LLC of Houston, TX, is voluntarily recalling approximately 448 Boxes of Better Weather Fix Elixir products, including all flavors and variations, because FDA analysis found the ...

2026-05-22 16:16 UTC
FIX Trading Community - Version 2.1.

web:www.fixtrading.org

Learn more Standards and Guidelines FIX standards have driven electronic trading for 30 years and are constantly updated to support industry needs Learn more Events and Community Our member-driven global educational and networking events bring the industry together Learn more

2026-05-22 16:16 UTC
NVD - Vulnerabilities

web:nvd.nist.gov

Mitigation of the vulnerabilities in this context typically involves coding changes, but could also include specification changes or even specification deprecations (e.g., removal of affected protocols or functionality in their entirety)."

2026-05-22 16:16 UTC
Broken and Updated Sims 4 Mods and CC: patch 1.124, May 12 and 21, 2026

web:forums.ea.com

About This Thread This thread tracks Sims 4 mods and CC that have been "broken" or made obsolete by game update1.124, May 12, 2026 , and the May 21 hotfix, or declared unsupported by their creators. It also tracks updated game mods, important updates to custom content, general news from/about creators, and new bugfix mods.

2026-05-22 16:16 UTC
Home - PATCH Hawaii

web:www.patchhawaii.org

PATCH provides access to registered and licensed child care, offers child care subsidies to eligible families, provides child development training and ECE scholarship opportunities, and assists those interested in starting a family child care business. PATCH is a free resource hub for families, child care professionals and communities of Hawaii.

2026-05-22 16:16 UTC
Pennsylvania Access To Criminal History - Home - pa

web:epatch.pa.gov

Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...

2026-05-22 16:16 UTC
Oracle Critical Patch Update Advisory - January 2026

web:www.oracle.com

Oracle Critical Patch Update Advisory - January 2026 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical ...

2026-05-22 16:16 UTC
2 New Microsoft Defender Zero-Days Exploited—Patch Now ... - Forbes

web:www.forbes.com

Microsoft has confirmed an emergency security update as CISA warns that two new Defender zero-days are being exploited by attackers.

2026-05-22 03:23 UTC
Rom Patcher JS

web:www.romhacking.net

Add temporary header() Patch file: Apply patch Original ROM: Modified ROM: Patch type: IPS BPS PPF UPS APS RUP Create patch Settings Rom Patcher JS v2.9 by Marc Robledo See on GitHub Donate Language English Français Deutsch Italiano Español Nederlands Svenska Català Valencià Português Brasileiro Russian 日本語中文（简体）中文 ...

2026-05-22 03:23 UTC
SAP Security Patch Day - May 2026

web:support.sap.com

SAP security Patch Day Bulletin

2026-05-22 03:23 UTC
CVE-2026-27071 — Missing Authorization in Arraytics Wpcafe | dbugs

web:dbugs.ptsecurity.com

Details on CVE-2026-27071 : Missing Authorization in Arraytics Wpcafe. Includes CVSS score, affected versions, and references.

2026-05-22 03:23 UTC
CVE-2026-27071 - Exploits & Severity - Feedly

web:feedly.com

Mitigation Immediately upgrade WPCafe to a version later than 3.0.7 if available. If no patched version is available, consider disabling or removing the WPCafe plugin until an update is released. Review and strengthen access control configurations. Implement Web Application Firewall (WAF) rules to detect and block unauthorized access attempts.

2026-05-22 03:23 UTC
patch.moe - Age Verification

web:patch.moe

Age Verification Are you 18 years or older? YES NO

2026-05-22 03:23 UTC
Patch - patch

web:patchnashville.com

Patch was born out of a love of children's fashion and classic yet modern gifting. The goal was to create a timeless yet modern boutique with a playful touch featuring children's clothing, gifts, & accessories. My hope is that you always find what you came for and feel as inspired by our collections as we are.

2026-05-22 03:23 UTC
May 12, 2026—KB5089549 (OS Builds 26200.8457 and 26100.8457)

web:support.microsoft.com

Improvements This update includes new features and quality improvements that were part of the following update: April 14, 2026—KB5083769 (OS Builds 26200.8246 and 26100.8246) April 30, 2026—KB5083631 (OS Builds 26200.8328 and 26100.8328) Preview This update addresses security vulnerabilities documented in the following guide: May 2026 Security Updates The following summary outlines key ...

2026-05-22 03:23 UTC
CVE-2026-27071 CVETodo

web:cvetodo.com

However, organizations should still assess their exposure and apply patches as recommended. How do I fix CVE-2026-27071 ? To remediate CVE-2026-27071 : Review the references section below for vendor advisories and mitigation guidance.

2026-05-22 03:23 UTC
Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days

web:www.bleepingcomputer.com

Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.

2026-05-22 03:23 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-27071.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-27071",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-26T19:53:29.444411Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-26T19:53:48.371Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "wp-cafe",
          "product": "WPCafe",
          "vendor": "Arraytics",
          "versions": [
            {
              "changes": [
                {
                  "at": "3.0.8",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "3.0.7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daroo | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-22T14:18:21.192Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects WPCafe: from n/a through <= 3.0.7.</p>"
            }
          ],
          "value": "Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-29T09:51:57.242Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/wp-cafe/vulnerability/wordpress-wpcafe-plugin-3-0-6-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress WPCafe plugin <= 3.0.7 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-27071",
    "datePublished": "2026-03-25T16:14:54.113Z",
    "dateReserved": "2026-02-17T13:23:51.341Z",
    "dateUpdated": "2026-04-29T09:51:57.242Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}