CVE-2023-47805 MEDIUM

CVE-2023-47805: WordPress WPCafe plugin <= 2.2.22 - Broken Access Control vulnerability

Vendor Arraytics
Product WPCafe
Weakness CWE-862 · Missing authorization
Published December 9, 2024
Last update April 29, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 2.2.22.

Explanation of Vulnerability in Simple Terms

02Summary

WPCafe versions up to 2.2.22 fail to properly check user permissions before allowing access to sensitive data. An attacker without authentication can read information they should not have access to by making direct requests to the application. This is a low-severity information disclosure vulnerability that does not require user interaction.

What an attacker can do

03Attacker Capabilities

Read sensitive information without logging in.

Potential impact on your site

04Site Impact

Unauthorized users can view data that should be restricted, such as user details or configuration information.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

December 9, 2024 CVE published
April 29, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57660 WordPress Booking and Rental Manager plugin <= 2.7.1 - Broken Access Control vulnerability CVE-2026-11600 Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting CVE-2026-57332 WordPress Wallet System for WooCommerce plugin <= 2.7.6 - Broken Access Control vulnerability CVE-2026-12902 Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions CVE-2026-12472 Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters