CVE-2026-85009: Unknown Restropress

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.

Affected products

• Unknown Restropress: up to and including 3.4.6

Published 2026-09-18. Last modified 2026-09-18.