CVE-2026-85009

Overview

The RestroPress WordPress plugin through version 3.4.6 lacks proper ownership verification within its payment-recovery functionality. This flaw allows unauthenticated remote actors to determine the state of customer orders and append arbitrary notes to existing orders. It matters because it impacts customer data integrity and exposes sensitive order metadata.

Description

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.

Impact

This vulnerability impacts the Integrity and Confidentiality of customer order data within affected WordPress installations. Unauthenticated attackers can enumerate recoverable orders and append arbitrary notes to other users' transactions. System administrators and store operators are directly impacted by potential data tampering and information disclosure. No direct impact on system availability is observed.

Remediation

Update the RestroPress plugin to a version later than 3.4.6 where proper authorization checks are enforced on the payment-recovery flow. Review recent order logs and database entries for suspicious or unauthorized notes. Implement web application firewall (WAF) rules to monitor and block anomalous requests targeting the payment recovery endpoints if patching is delayed.

Risk context

This vulnerability is rated as medium severity with a CVSS v3 score of 5.3, indicating moderate risk. EPSS data is currently not available for this identifier. Urgency is moderate since exploitation requires no authentication but is limited to enumeration and note manipulation rather than full system compromise.

Affected products

• RestroPress RestroPress plugin <= 3.4.6