These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure. This allows unauthenticated users to disclose guest order information and to change the status of, or trash, any order. Defenders should assess exposure and prioritize verification and remediation efforts based on t [truncated]
CVE-2026-66587 is a critical unauthenticated local file inclusion vulnerability in WP Cafe Pro versions prior to 3.0.15. Defenders should assess exposure, prioritize remediation, and verify inventory for potential impact.
CVE-2026-66585 is a high-severity vulnerability in WP Cafe Pro plugin versions prior to 3.0.15, allowing unauthenticated sensitive data exposure. The vulnerability has a CVSS score of 7.5 and is classified as CWE-201. Defenders responsible for WP Cafe Pro plugin installations should assess exposure and prioritize remediation. The CVE record and NVD entry provide limited information about the vulnerability [truncated]