Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
Vulnerability Database/CVE-2026-84044

CVE-2026-84044: WordPress Restaurant Menu Auth Bypass Flaw

CVE-2026-84044 is an authentication bypass flaw in the Restaurant Menu and Food Ordering WordPress plugin that lets attackers forge PayPal payment notifications to mark orders as paid without payment. This post explains its impact, affected versions, and mitigation steps.

Published:

CVE-2026-84044 Overview

CVE-2026-84044 affects the Restaurant Menu and Food Ordering WordPress plugin in versions prior to 2.4.12. The plugin fails to verify that PayPal Instant Payment Notification (IPN) messages originate from PayPal. Unauthenticated attackers can forge payment notifications and mark their own orders as paid and completed without transferring funds. The flaw represents a business logic error affecting the payment confirmation workflow. Restaurants using the vulnerable plugin face direct financial loss through fraudulent order fulfillment.

Critical Impact

Unauthenticated attackers can forge PayPal payment notifications to receive food orders without payment, causing direct revenue loss to affected merchants.

Affected Products

  • Restaurant Menu and Food Ordering WordPress plugin versions before 2.4.12
  • WordPress sites using the plugin for PayPal-based order processing
  • Merchant deployments relying on PayPal IPN for order confirmation

Discovery Timeline

  • 2026-09-04 - CVE-2026-84044 published to NVD
  • 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-84044

Vulnerability Analysis

The vulnerability is a business logic error in the PayPal payment confirmation handler. The plugin exposes an endpoint that receives payment notifications and updates order status based on the received data. The handler does not validate the authenticity of the notification against PayPal's IPN verification service. Any unauthenticated party can send a crafted HTTP request that mimics a PayPal notification and the plugin will accept it as valid.

This creates an integrity impact on order records. Attackers do not gain access to sensitive data or disrupt availability, but they can manipulate transaction state to trigger order fulfillment without payment. The Exploit Prediction Scoring System (EPSS) currently rates the probability of exploitation at 0.117%.

Root Cause

The root cause is missing origin verification for inbound PayPal IPN messages. PayPal's IPN protocol requires the receiver to echo the raw notification back to PayPal for validation before trusting its contents. The vulnerable plugin skips this handshake and treats any incoming POST request as an authentic payment confirmation. The result is a broken trust boundary between the merchant application and the payment processor.

Attack Vector

The attack requires no authentication and no user interaction. An attacker places an order through the normal checkout flow, then sends a forged HTTP POST request to the plugin's payment notification endpoint. The forged request contains order identifiers and a status field indicating successful payment. The plugin marks the order as paid and completed, and the merchant processes the order for delivery. Full technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-84044

Indicators of Compromise

  • Orders marked as paid without a matching transaction in the PayPal merchant dashboard
  • Inbound HTTP POST requests to the plugin's PayPal notification endpoint from IP addresses outside PayPal's published IPN ranges
  • Order completion events lacking a corresponding IPN validation callback to ipnpb.paypal.com or www.paypal.com
  • Unusual volume of completed low-value or first-time customer orders

Detection Strategies

  • Compare WordPress order records against PayPal transaction reports to identify discrepancies in paid status
  • Enable request logging on the WordPress site and inspect all traffic reaching the plugin's IPN handler
  • Monitor outbound connections from the web server to PayPal verification endpoints and flag their absence when orders are marked paid

Monitoring Recommendations

  • Alert on any completed order that lacks a validated PayPal transaction identifier
  • Log source IP, User-Agent, and payload for every request to the payment notification endpoint
  • Reconcile daily order totals with PayPal settlement reports to detect fraudulent completions early

How to Mitigate CVE-2026-84044

Immediate Actions Required

  • Update the Restaurant Menu and Food Ordering plugin to version 2.4.12 or later
  • Audit all recent orders against PayPal transaction records and cancel any unmatched fulfillments
  • Restrict access to the PayPal IPN endpoint at the web server or WAF layer to PayPal's published IP ranges until patched

Patch Information

Upgrade the Restaurant Menu and Food Ordering WordPress plugin to version 2.4.12 or later. The fixed release adds server-side verification of PayPal IPN messages before updating order status. Consult the WPScan Vulnerability Report for advisory details.

Workarounds

  • Temporarily disable the plugin's PayPal payment method and require manual order confirmation until the patch is applied
  • Deploy a Web Application Firewall (WAF) rule that blocks POST requests to the IPN endpoint from non-PayPal source addresses
  • Switch to an alternative payment gateway integration that enforces cryptographic verification of payment callbacks

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne