What is CVE-2026-12981?

CVE-2026-12981 is a high-severity vulnerability in Cafehaus API, classified under Improper Privilege Management. CVSS score: 7.5/10. Published 2026-07-24.

How severe is CVE-2026-12981?

High severity. CVSS v3 base score is 7.5 out of 10.

Privilege escalation in Cafehaus API

CVE-2026-12981

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.

Vulnerability class: Privilege Escalation

EPSS: 0.003 (22.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Unknown Cafehaus Api — versions 0

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-12981?: CVE-2026-12981 is a high-severity vulnerability in Cafehaus API, classified under Improper Privilege Management. CVSS score: 7.5/10. Published 2026-07-24.
How severe is CVE-2026-12981?: High severity. CVSS v3 base score is 7.5 out of 10.