RestroPress EUVD-2026-82664

No special conditions - remote unauthenticated exploitation against default configurations of the RestroPress WordPress plugin (versions up to and including 3.4.6). The attacker only needs network access to a site running the vulnerable plugin and the ability to supply an order identifier to the payment-recovery flow; no authentication, credentials, or user interaction is required. Limiting factors: impact is confined to enumerating recoverable order states and writing notes to arbitrary orders (no code execution, no full order-data exfiltration, no destruction), and exploitation is only meaningful on sites that use RestroPress's payment/order functionality.

Real-world risk is moderate, not critical. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5) is credible and consistent with a classic insecure-direct-object-reference / broken-authorization flaw (CWE-639): network-reachable, no privileges, no user interaction, but with only Low confidentiality (enumerating which orders are in a recoverable state) and Low integrity (writing notes to another customer's order) and no availability impact. A public exploit exists (WPScan), which raises practical exploitability, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or automated mass exploitation. The signals are internally consistent (no CVSS-vs-description conflict on attack vector or privilege). The main caveat: this is a data-tampering/enumeration issue, not RCE or account takeover, so the 6.5 'Medium' rating overstates operational urgency relative to a same-scored memory-corruption bug. Prioritize patching, but this is a lower-tier priority than credential, RCE, or SQLi issues. The 'Authentication Bypass' tag is misleading - the flaw is missing ownership/authorization checks on an already-public flow, not a bypass of authentication.

An unauthenticated attacker sends crafted requests to the RestroPress payment-recovery endpoint, iterating order identifiers to learn which orders are in a recoverable state (order enumeration) and then writing arbitrary notes onto other customers' orders. A public exploit/write-up is available via WPScan, lowering the skill barrier. There is no code execution or data exfiltration beyond order-state metadata, so impact is limited to information leakage and unauthorized note injection.