CVE-2026-84044: Unknown Restaurant Menu And Food Ordering

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment.

Affected products

• Unknown Restaurant Menu And Food Ordering: before 2.4.12 (fixed in 2.4.12)

Published 2026-09-04. Last modified 2026-09-08.