CVE-2026-12981

HighCVSS 7.5/10Last modified Jul 24, 2026

Description

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
Unknown	CAFEHAUS API	<= 1.0.0

References

https://wpscan.com/vulnerability/79fa8b91-f88e-4249-9f17-9e98e879f6fa/

Timeline

Published: Jul 24, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-129826.1The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the respons CVE-2026-129838.6The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated u CVE-2026-129848.2Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WA CVE-2026-129859.3Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect CVE-2026-129867.3A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows th CVE-2026-129877.5The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mo CVE-2026-129886.4The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs t CVE-2026-129898.7A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to CVE-2026-12996.0The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email mess CVE-2026-129907.7An access control vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to CVE-2026-129918.7The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot (APK v5.5 CVE-2026-129927.4A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments f