7 matches found
CVE-2026-85009
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order...
EUVD-2026-82664
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order...
CVE-2026-85009 RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order...
CVE-2026-85009 RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order...
CVE-2026-85009
The RestroPress WordPress plugin, in versions 3.4.6 and earlier , contains an authorization bypass vulnerability in its payment-recovery flow . The software fails to verify ownership before processing a request-supplied order identifier. This allows unauthenticated attackers to enumerate orders i...
PT-2026-95237
Name of the Vulnerable Software and Affected Versions RestroPress versions prior to 3.4.7 Description The payment-recovery flow fails to verify ownership before processing a request-supplied order identifier. This allows unauthenticated attackers to identify which orders are in a recoverable stat...
CVE-2026-85009: Authorization Bypass Through User-Controlled Key
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order...