CVE-2026-86816

{
  "etk_id": "ETK-2026-1317",
  "cve_id": "CVE-2026-86816",
  "display_id": "CVE-2026-86816",
  "ghsa_id": "GHSA-f9g2-rh86-5c4p",
  "euvd_id": "EUVD-2026-94186",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper REST API access control in WPCafe",
  "summary": "WPCafe versions earlier than 3.0.21 expose certain REST API routes without adequate authentication checks. An unauthenticated remote attacker can retrieve WooCommerce product information, including inventory, sales, and private metadata, when the affected plugin and WooCommerce data are present.",
  "mitigation": "Update WPCafe to version 3.0.21 or later. Until it is updated, restrict public access to the affected site's REST API endpoints where operationally feasible.",
  "vendor": null,
  "product": "WPCafe",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.0.21"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.0.21"
      ],
      "package_name": "WPCafe",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 5.3,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "epss_score": 0.0023,
  "epss_percentile": 0.1323,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": true,
  "pipeline_minutes": 48.428864366666666,
  "t0_at": "2026-10-07T06:00:08.124000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-12T07:25:44.098891+00:00",
      "days": 5.059444153831018,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T06:00:08.124000+00:00",
      "url": null
    },
    "exploit": {
      "at": "2026-10-12T07:25:44.098891+00:00",
      "days": 5.059444153831018,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T06:00:08.124000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-07T06:00:08.124000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T06:00:08.124000+00:00",
      "url": "https://github.com/advisories/GHSA-f9g2-rh86-5c4p"
    }
  }
}