medium5.3
CVE-2026-85010
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in th…
Impact
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.
Affected products
| Product | Affected versions |
|---|---|
| RestroPress WordPress Plugin | before 3.4.6 |
Versions were read from the advisory text. No structured product data has been published for this record yet.