UNKNOWN NVD

CVE-2026-85009

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, all

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.

References

https://wpscan.com/vulnerability/9731b0f3-76c2-4e0a-9630-9160299a37ee/

Published: 2026-09-18 · Source: NVD · Feed updated: 2026-09-18

This unknown severity vulnerability was published on 2026-09-18 via NVD.

vulnfeed aggregates 14468 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.