CVE-2026-12981
⚠️ highSummary
The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.
CVSS Score
7.5
High
EPSS Score
0.3
Exploit Probability
Published Date
2026-07-24
First Seen: 2026-07-31
📊 Relative Risk Intelligence
This CVE is Moderate Risk - more severe than 68.5% of all 340,620 vulnerabilities in our database.
#107,155
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 24, 2026
🔍 Exploitation Status
Poc
Proof-of-concept available
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
moonge
WPScan (coordinator)
SSVC data provided by
CISA
Last Modified
2026-07-24
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE IDs (Weakness Types)