WordPress Plugin Vulnerabilities

RestroPress <= 3.4.7 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery

Description

The plugin does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.

Proof of Concept

Affects Plugins

Plugin icon
restropress
No known fix

References

CVE
CVE-2026-85009

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Usama Arshad
Submitter
Usama Arshad
Submitter website
https://www.usamaarshad.me/
Submitter twitter
usama0x01
Verified
Yes
WPVDB ID
9731b0f3-76c2-4e0a-9630-9160299a37ee

Timeline

Publicly Published
2026-09-16 (about 2 days ago)
Added
2026-09-09 (about 8 days ago)
Last Updated
2026-09-17 (about 14 hours ago)

Other

Published
Title
Published
2026-01-06
Title
User Activity Log <= 2.2 - Unauthenticated Limited Arbitrary Option Update
Published
2025-12-31
Title
Order Cancellation & Returns for WooCommerce < 1.1.13 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-02-09
Title
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace < 2.11.9 - Insecure Direct Object Reference to Update Membership Payment
Published
2024-04-05
Title
BookingPress < 1.0.82 - Authenticated (Customer+) Insecure Direct Object Reference
Published
2025-03-13
Title
WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover