Vulnerabilities / WPCafe / WPSEC-2026-1313
WPCafe <= 3.0.22 - Unauthenticated Sensitive Information Exposure via Localized Plugin Settings
Medium 5.3
CWE-200Fixed in 3.0.23
- ID
- WPSEC-2026-1313
- Plugin
- WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System (wp-cafe)
- Affected
- all versions before 3.0.23
- Remediation
- Update to 3.0.23 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-21
- Attack surface
- WPCafe on WPSec AttackSurface
- Fix released
- Published
Description
The WPCafe plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'wpc_form_client_data' JavaScript object in all versions up to, and including, 3.0.22. This is due to the plugin putting its complete stored settings array into the front-end page source with wp_localize_script(). This makes it possible for unauthenticated attackers to read configured integration secrets, such as the WhatsApp access token and Facebook app secret and the automation webhook URLs, from the source of any page where the plugin's public scripts load, including the WooCommerce shop, cart and checkout pages.
References
- https://wpsec.com/vuln/WPSEC-2026-1313/
- https://plugins.svn.wordpress.org/wp-cafe/tags/3.0.23/
- https://wordpress.org/plugins/wp-cafe/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS