Cyber Resilience

CVE-2026-27071

Critical

Published: 25 March 2026

Published
25 March 2026
Modified
24 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS Score 0.0030 21.7th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-27071 is a critical-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2026-27071 is a missing authorization vulnerability (CWE-862) in the Arraytics WPCafe WordPress plugin (wp-cafe). It enables exploitation of incorrectly configured access control security levels and affects all versions from n/a through 3.0.7. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), highlighting its critical severity due to network accessibility and high impacts on integrity and availability.

Remote unauthenticated attackers can exploit this issue over the network with low attack complexity and no user interaction. Exploitation allows attackers to perform unauthorized actions that compromise data integrity and service availability, such as modifying critical resources or disrupting plugin functionality.

The Patchstack advisory provides further details on this broken access control vulnerability in the WPCafe plugin: https://patchstack.com/database/Wordpress/Plugin/wp-cafe/vulnerability/wordpress-wpcafe-plugin-3-0-6-broken-access-control-vulnerability?_s_id=cve.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7.

CWE(s)
CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
attack.mitre.org →
Why these techniques?

Missing authorization (CWE-862) in public-facing WordPress plugin directly enables remote exploitation of the application (T1190) and unauthorized modification of critical resources (T1565.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-0952Shared CWE-862
CVE-2026-34053Shared CWE-862
CVE-2025-1657Shared CWE-862
CVE-2026-27386Shared CWE-862
CVE-2026-3360Shared CWE-862
CVE-2025-24591Shared CWE-862
CVE-2026-4277Shared CWE-862
CVE-2025-26733Shared CWE-862
CVE-2024-12920Shared CWE-862
CVE-2026-4283Shared CWE-862

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces approved authorizations for access to system resources, preventing exploitation of the missing authorization vulnerability in WPCafe.

AC-24 Access Control Decisions good match
prevent

Requires explicit authorization decisions and enforcement mechanisms for system resources, addressing the broken access control in WPCafe that allows unauthorized actions.

AC-6 Least Privilege partial match
prevent

Enforces least privilege to restrict unauthorized actions enabled by missing authorization checks in the WPCafe plugin.

References