CVE-2026-86816

MediumCVSS 5.3/10Last modified Oct 7, 2026

Description

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind authentication.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Oct 7, 2026
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-868174.9The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema fiel CVE-2026-868184.8fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. CVE-2026-868197.1Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients CVE-2026-86824.3The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On plugin for WordPress is vulnerable to authorization bypass in all versi CVE-2026-868235.3The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action CVE-2026-868244.8The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its trackin CVE-2026-868265.9The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, a CVE-2026-868275.3The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originate CVE-2026-868286.6The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when CVE-2026-86836.5Mattermost Desktop App versions <=6.1 5.5.13.0 fail to account for attempting to open extremely long URLs in the Mattermost Desktop App whic CVE-2026-868307.2Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 migh CVE-2026-868318.7Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an