EUVD-2026-82664
GHSA-v23v-8m6m-59wf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public payment-recovery endpoint
-
DeliverySupply arbitrary order identifier
-
ExploitBypass missing ownership check
-
ExecutionEnumerate recoverable orders / write notes to victim order
-
ImpactOrder-state disclosure and data tampering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the RestroPress WordPress plugin (versions up to and including 3.4.6). The attacker only needs network access to a site running the vulnerable plugin and the ability to supply an order identifier to the payment-recovery flow; no authentication, credentials, or user interaction is required. Limiting factors: impact is confined to enumerating recoverable order states and writing notes to arbitrary orders (no code execution, no full order-data exfiltration, no destruction), and exploitation is only meaningful on sites that use RestroPress's payment/order functionality. |
| Impact | Real-world risk is moderate, not critical. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5) is credible and consistent with a classic insecure-direct-object-reference / broken-authorization flaw (CWE-639): network-reachable, no privileges, no user interaction, but with only Low confidentiality (enumerating which orders are in a recoverable state) and Low integrity (writing notes to another customer's order) and no availability impact. A public exploit exists (WPScan), which raises practical exploitability, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or automated mass exploitation. The signals are internally consistent (no CVSS-vs-description conflict on attack vector or privilege). The main caveat: this is a data-tampering/enumeration issue, not RCE or account takeover, so the 6.5 'Medium' rating overstates operational urgency relative to a same-scored memory-corruption bug. Prioritize patching, but this is a lower-tier priority than credential, RCE, or SQLi issues. The 'Authentication Bypass' tag is misleading - the flaw is missing ownership/authorization checks on an already-public flow, not a bypass of authentication. |
| Exploit ScenarioDerived | An unauthenticated attacker sends crafted requests to the RestroPress payment-recovery endpoint, iterating order identifiers to learn which orders are in a recoverable state (order enumeration) and then writing arbitrary notes onto other customers' orders. A public exploit/write-up is available via WPScan, lowering the skill barrier. There is no code execution or data exfiltration beyond order-state metadata, so impact is limited to information leakage and unauthorized note injection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Missing ownership verification in the RestroPress WordPress plugin through 3.4.6 lets remote, unauthenticated attackers enumerate which orders are in a recoverable state and inject arbitrary notes into other customers' orders simply by supplying an order identifier to the payment-recovery flow. The flaw is an IDOR-class authorization bypass (CWE-639) with a CVSS 3.1 score of 6.5 on the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, so no credentials, privileges, or user interaction are required and default configurations are exploitable wherever the plugin's payment/order functionality is in use. Publicly available exploit code exists and the issue was reported by WPScan; impact remains confined to order-state disclosure and note injection (no code execution, no full order-data exfiltration, no destruction), so real-world risk is moderate rather than critical.
RemediationAI
No vendor-released patch identified at time of analysis: the supplied data contains no fixed version beyond the affected 'through 3.4.6' range, so administrators should treat 3.4.6 and earlier as vulnerable and confirm against the WPScan advisory (https://wpscan.com/vulnerability/9731b0f3-76c2-4e0a-9630-9160299a37ee/) and the plugin's changelog whether a newer release addresses the missing ownership check - do not assume the next point release is fixed without confirmation. Where the plugin is not essential, deactivating and removing it eliminates the exposure entirely, at the cost of losing all restaurant ordering and payment-recovery functionality. If the plugin must stay, block unauthenticated requests to the payment-recovery action at the web server, reverse proxy, or WAF layer (the WPScan advisory names the affected endpoint/action), accepting that logged-out customers using the legitimate recovery flow will also be blocked; alternatively, disable order-note writing and the recovery workflow in the plugin's settings if those toggles exist, which degrades customer-facing features. Restrict administrative access to wp-admin and the WordPress REST/AJAX surface to trusted networks as a general containment measure, though this does not stop the unauthenticated public-facing request path. For detection, monitor for high-volume sequential order-identifier requests to recovery endpoints and audit order notes for unexpected author or content changes, since note injection leaves a durable trace; alerting on these patterns provides early warning while a fix is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic Insecure Direct Object Reference / authorization bypass through a user-controlled key (CWE-639). RestroPress is a WordPress plugin that adds restaurant ordering and payment workflows, and its payment-recovery flow accepts a request-supplied order identifier and then acts on that order without confirming that the requester owns it. Because WordPress exposes plugin endpoints to unauthenticated visitors, the missing ownership check turns the order identifier into a direct object reference: the attacker iterates or guesses identifiers to learn which orders are in a recoverable state, and can also append notes to orders belonging to other customers. The affected CPE is recorded as cpe:2.3:a:unknown:restropress:*:*:*:*:*:*:*:*, reflecting an unregistered vendor namespace rather than a technical limitation; the plugin's runtime is standard WordPress/PHP, so the root cause is purely logical rather than a memory-safety or injection flaw. ENISA assigned EUVD-2026-82664 to track the same issue, and the underlying technical detail is documented in the WPScan advisory referenced in the CVE record. There is no evidence in the available data of any chained primitive such as SQL injection or file upload, which is consistent with the limited C:L/I:L impact and no availability impact.
Know when Restropress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated remote request (PR:N/AV:N/AC:L/UI:N); order-state enumeration gives C:L and cross-customer note injection gives I:L; no availability or scope change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB