CVE-2026-85009: RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need to authenticate. Exploitation requires sending requests through the payment-recovery flow with a supplied order identifier.
What can an attacker do with the payment-recovery flow?
They can enumerate orders that are in a recoverable state and add notes to another customer's order. The issue is caused by missing ownership verification for the supplied order identifier.
Are installations running the affected plugin versions exposed by default?
The available information identifies the payment-recovery flow as the affected feature, but does not state whether it is enabled or reachable in a default configuration.