WordPress Plugin Vulnerabilities

Restaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Payment Bypass via Forged PayPal IPN

Description

The plugin does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment.

Proof of Concept

Affects Plugins

Plugin icon
mp-restaurant-menu
Fixed in 2.4.12

References

CVE
CVE-2026-84044

Miscellaneous

Original Researcher
Muni Nitish Kumar Yaddala
Submitter
Muni Nitish Kumar Yaddala
Verified
Yes
WPVDB ID
861a7030-f85c-4452-8eeb-68a3407f6815

Timeline

Publicly Published
2026-09-02 (about 2 days ago)
Added
2026-09-02 (about 1 day ago)
Last Updated
2026-09-02 (about 1 day ago)

Other

Published
Title
Published
2022-09-26
Title
Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass
Published
2019-04-11
Title
YellowPencil Visual CSS Style Editor <= 7.2.0 - Unauthenticated Arbitrary Options Updates
Published
2026-08-17
Title
myCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED
Published
2018-02-08
Title
Swape Theme - Authentication Bypass and Stored XSS
Published
2023-10-24
Title
YOP Poll < 6.5.29 - Reusable Captcha via validateImage