# WPCafe <= 3.0.22 - Unauthenticated Sensitive Information Exposure via Localized Plugin Settings

- **ID:** WPSEC-2026-1313
- **Plugin:** WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System (`wp-cafe`), https://wordpress.org/plugins/wp-cafe/
- **Affected versions:** all versions before 3.0.23
- **Fixed in:** 3.0.23 (Update to 3.0.23 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-cafe
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1313/

## Description

The WPCafe plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'wpc_form_client_data' JavaScript object in all versions up to, and including, 3.0.22. This is due to the plugin putting its complete stored settings array into the front-end page source with wp_localize_script(). This makes it possible for unauthenticated attackers to read configured integration secrets, such as the WhatsApp access token and Facebook app secret and the automation webhook URLs, from the source of any page where the plugin's public scripts load, including the WooCommerce shop, cart and checkout pages.

## References

- https://wpsec.com/vuln/WPSEC-2026-1313/
- https://plugins.svn.wordpress.org/wp-cafe/tags/3.0.23/
- https://wordpress.org/plugins/wp-cafe/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1313/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.