CVE-2026-85009 — RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery

CVE-2026-85009

RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery PUBLISHED

Description (CNA)

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.

Affected (CNA)

Vendor / product	Versions
Unknown / RestroPress	affected 0 through 3.4.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/9731b0f3-76c2-4e0a-9630-9160299a37ee/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.