CVE-2026-12981 CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset
Unauthenticated attackers can reset any user's password, including administrators, leading to full account takeover in the CAFEHAUS API plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12981?
CVE-2026-12981 is a high-severity missing authorization vulnerability in Unknown CAFEHAUS API, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.
Weakness: CWE-269
Which versions are affected by CVE-2026-12981?
How do I fix CVE-2026-12981?
No fix has been published for CVE-2026-12981 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-12981 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-12981 exists.
Sources
Also known as GHSA-3j3x-65ff-623h.