CVE-2026-85010
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart. This allows unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.
Risk Assessment
An attacker can place an order for an arbitrary, reduced amount, including zero, leading to financial losses for the store owner. The risk affects WordPress sites with the RestroPress plugin installed.
Recommendation
Update the RestroPress plugin to version 3.4.6 or later. Ensure that add-on prices are validated on the server side.
Other vulnerabilities in RestroPress
See all- CVE-2026-85009Medium
The RestroPress WordPress plugin through version 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
- CVE-2025-69017Medium
Stored XSS vulnerability in RestroPress (WordPress plugin) allows an attacker to inject malicious script into the page, which executes in the user's browser. Affects versions up to and including 3.2.8.6.
Original NVD description (English source)
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS