What is GHSA-3j3x-65ff-623h?

GHSA-3j3x-65ff-623h is a security advisory published by GitHub Security Advisories with High severity. The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation...

Which CVE IDs does GHSA-3j3x-65ff-623h cover?

GHSA-3j3x-65ff-623h covers the following CVE IDs: CVE-2026-12981. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3j3x-65ff-623h?

GHSA-3j3x-65ff-623h has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-3j3x-65ff-623hHighCVSS 7.5

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation...

Vendor

GitHub Security Advisories

Published

July 24, 2026

Last Modified

July 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-12981 →

📋 Description

The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-12981
https://wpscan.com/vulnerability/79fa8b91-f88e-4249-9f17-9e98e879f6fa
https://github.com/advisories/GHSA-3j3x-65ff-623h