CVE-2026-84044

MediumCVSS 5.3

Published: 04/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment.

Risk Assessment

Risk of financial loss and order fraud, as attackers can obtain products or services without paying.

Recommendation

Update the plugin to version 2.4.12 or later, which includes a fix for verifying the origin of PayPal notifications.

Other vulnerabilities in Restaurant Menu and Food Ordering

CVE-2026-96568High
The Restaurant Menu and Food Ordering plugin for WordPress (up to and including 2.4.14) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'phone_number' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits the injected page.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS