Unknown Restropress vulnerabilities

2 CVEs affecting Unknown Restropress, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85010, published 2026-09-21.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-85010, published 2026-09-21. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users…
• CVE-2026-85009, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to…