6.5
Moyenne
CVE-2026-85009 The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting…
Description
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| RestroPress 3.4 | premières → 3.4.6 | Pas de correctif indiqué |