5.3
Medium
CVE-2026-85010 The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side…
Description
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| RestroPress 3.4 | earliest → < 3.4.6 | 3.4.6 |