CVE-2026-27071
Published: 25 March 2026
Summary
CVE-2026-27071 is a critical-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved authorizations for access to system resources, preventing exploitation of the missing authorization vulnerability in WPCafe.
Requires explicit authorization decisions and enforcement mechanisms for system resources, addressing the broken access control in WPCafe that allows unauthorized actions.
Enforces least privilege to restrict unauthorized actions enabled by missing authorization checks in the WPCafe plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) in public-facing WordPress plugin directly enables remote exploitation of the application (T1190) and unauthorized modification of critical resources (T1565.001).
NVD Description
Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7.
Deeper analysisAI
CVE-2026-27071 is a missing authorization vulnerability (CWE-862) in the Arraytics WPCafe WordPress plugin (wp-cafe). It enables exploitation of incorrectly configured access control security levels and affects all versions from n/a through 3.0.7. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), highlighting its critical severity due to network accessibility and high impacts on integrity and availability.
Remote unauthenticated attackers can exploit this issue over the network with low attack complexity and no user interaction. Exploitation allows attackers to perform unauthorized actions that compromise data integrity and service availability, such as modifying critical resources or disrupting plugin functionality.
The Patchstack advisory provides further details on this broken access control vulnerability in the WPCafe plugin: https://patchstack.com/database/Wordpress/Plugin/wp-cafe/vulnerability/wordpress-wpcafe-plugin-3-0-6-broken-access-control-vulnerability?_s_id=cve.
Details
- CWE(s)