CVE-2026-85009

The RestroPress WordPress plugin (versions ≤ 3.4.6 ) contains an unauthenticated order enumeration and note modification vulnerability in its payment-recovery flow . The plugin does not verify ownership before acting on a request-supplied order identifier, allowing unauthenticated attackers to en...