What is GHSA-f9g2-rh86-5c4p?

GHSA-f9g2-rh86-5c4p is a security advisory published by GitHub Security Advisories with Medium severity. The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API...

Which CVE IDs does GHSA-f9g2-rh86-5c4p cover?

GHSA-f9g2-rh86-5c4p covers the following CVE IDs: CVE-2026-86816. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f9g2-rh86-5c4p?

GHSA-f9g2-rh86-5c4p has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-f9g2-rh86-5c4pMediumCVSS 5.3

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API...

Vendor

GitHub Security Advisories

Published

October 7, 2026

Last Modified

October 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-86816 →

📋 Description

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind authentication.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-86816
https://wpscan.com/vulnerability/e644bbb2-aae7-4f7a-baf7-34e578bcee2a
https://github.com/advisories/GHSA-f9g2-rh86-5c4p