Security Alert Summary
The RestroPress WordPress plugin before 3.4.6 fails to validate a client-supplied item add-on price on the server when items are added to or updated in the cart. This allows unauthenticated users to set arbitrary prices and place orders for attacker-chosen totals, including zero, which can result in manipulated order amounts and inconsistent store accounting.
CVE Details
- CVE ID:
CVE-2026-85010 - Affected component: RestroPress WordPress plugin
- Affected versions: Versions before 3.4.6 (less than 3.4.6)
- Published: September 21, 2026 at 9:17:05 AM UTC
- Last modified: September 21, 2026 at 3:17:32 PM UTC
- CVSS v3.1: Base score 5.3 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: None; user interaction: None
- Primary impact: Integrity: Low; Confidentiality: None; Availability: None
- CWE: CWE-472 (External Control of File Name or Path)
Technical Details
The plugin does not perform server-side validation of a client-supplied add-on price when items are added to or updated in the cart. Because the server accepts the submitted price value, an unauthenticated actor can provide arbitrary numeric values for item add-ons and submit orders reflecting those manipulated totals. The description indicates the issue occurs during cart add/update operations; no specific function names or REST endpoints are provided in the CVE data.
Impact is limited to manipulation of order pricing and totals. The vulnerability does not indicate direct exposure of stored credentials or administrative controls, but it permits attackers to create orders with attacker-chosen totals, including zero-priced orders, which may affect accounting and order workflows.
How This Could Impact Your Website
Imagine a site owner running an online food ordering workflow with internal staff handling orders and an external contractor managing menu items. An unauthenticated attacker could submit orders with manipulated prices, causing payment discrepancies and extra manual work for staff reconciling orders. While the CVSS data indicates no direct confidentiality impact, manipulated orders interacting with customer-facing flows could indirectly increase the risk of targeted phishing or social engineering attempts if attackers interact with customer or order interfaces.
Practical consequences may include:
- Incorrect order totals and accounting reconciliation overhead for the owner and staff
- Potential abuse of order workflows that creates noise for staff and contractors
- Increased risk of social engineering or targeted phishing due to attacker interaction with public order processes
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site and store activity for unusual orders, spikes in zero-value or low-value orders, and other anomalous behavior.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
