CVE-2026-85009
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The RestroPress WordPress plugin through version 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
Risk Assessment
The risk includes privacy breach of order data and potential manipulation of notes, affecting the integrity of customer service processes.
Recommendation
Update the plugin to the latest version and restrict access to the payment recovery feature.
Other vulnerabilities in RestroPress
See all- CVE-2026-85010Medium
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart. This allows unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.
- CVE-2025-69017Medium
Stored XSS vulnerability in RestroPress (WordPress plugin) allows an attacker to inject malicious script into the page, which executes in the user's browser. Affects versions up to and including 3.2.8.6.
Original NVD description (English source)
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS