CVE-2026-85009: RestroPress WordPress Auth Bypass Flaw

CVE-2026-85009 Overview

CVE-2026-85009 affects the RestroPress WordPress plugin through version 3.4.6. The plugin fails to verify ownership in its payment-recovery flow before acting on a request-supplied order identifier. Unauthenticated attackers can enumerate which orders are in a recoverable state and write notes to another customer's order.

The issue is classified as an Insecure Direct Object Reference (IDOR) tracked under CWE-639. Because the flow accepts attacker-supplied identifiers without authorization checks, any remote user can interact with arbitrary orders belonging to other customers.

Critical Impact

Unauthenticated attackers can enumerate recoverable orders and inject arbitrary notes into other customers' orders, exposing order state and enabling social-engineering or fraud workflows against restaurant operators.

Affected Products

• RestroPress WordPress plugin versions up to and including 3.4.6
• WordPress sites running RestroPress with the payment-recovery flow enabled
• Restaurant and food-ordering sites relying on RestroPress for order management

Discovery Timeline

• 2026-09-18 - CVE-2026-85009 published to NVD
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-85009

Vulnerability Analysis

RestroPress exposes a payment-recovery workflow that accepts an order identifier supplied in the request. The handler acts on that identifier without confirming the requester owns the referenced order. This is a textbook Insecure Direct Object Reference pattern.

An unauthenticated attacker can iterate order identifiers and observe server responses to distinguish which orders exist in a recoverable state. The same handler path allows the attacker to write notes to any referenced order, regardless of the ownership boundary that should exist between customers.

The impact combines information disclosure (recoverable order enumeration) with integrity impact (unauthorized note injection). Availability is not affected. Attackers do not need credentials, user interaction, or elevated privileges to exercise the flaw.

Root Cause

The root cause is missing authorization on the payment-recovery endpoint. The plugin trusts the order identifier submitted in the request instead of validating it against the current session, order token, or authenticated customer context. This violates the reference-authorization model described in CWE-639.

Attack Vector

Exploitation occurs over the network against the public WordPress front end. An attacker sends crafted HTTP requests to the payment-recovery endpoint with sequential or guessed order identifiers. The server discloses recoverability state through its response, and it accepts note contents that get persisted against the target order.

No exploit code is publicly published. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-85009

Indicators of Compromise

• Unexpected order notes appearing on customer orders without corresponding staff or customer activity
• Bursts of HTTP requests to RestroPress payment-recovery endpoints containing sequential order identifiers
• Access log entries from unauthenticated sessions referencing many distinct order IDs in a short window
• Customer complaints referencing order content or messages they did not submit

Detection Strategies

• Review WordPress access logs for repeated requests to the RestroPress payment-recovery route, particularly from single source IPs iterating IDs
• Audit the wp_posts and RestroPress order metadata tables for notes added outside normal business hours or without an associated user ID
• Correlate order-note creation events with the authenticated user context; unauthenticated writes are anomalous

Monitoring Recommendations

• Enable verbose logging on the RestroPress plugin routes and forward logs to a centralized SIEM for correlation
• Alert on high-cardinality access to order identifier parameters from a single client within short intervals
• Track order-note creation rates per site and baseline normal activity to surface anomalies

How to Mitigate CVE-2026-85009

Immediate Actions Required

• Upgrade RestroPress beyond version 3.4.6 as soon as a patched release is available from the vendor
• Restrict access to the payment-recovery endpoint at the web server or WAF layer until a fix is applied
• Audit existing orders for unauthorized notes and remove attacker-injected content
• Notify affected customers if unauthorized note injection is confirmed against their orders

Patch Information

No fixed version is listed in the NVD record at time of publication. Monitor the WPScan Vulnerability Report and the RestroPress plugin changelog for a patched release addressing the missing authorization in the payment-recovery flow.

Workarounds

• Deploy a WAF rule that blocks unauthenticated requests to the RestroPress payment-recovery endpoint
• Disable the payment-recovery feature in plugin settings if operationally acceptable
• Enforce authentication at the reverse proxy for the affected route until the vendor ships a fix

# Example nginx rule to block unauthenticated access to the recovery endpoint
location ~* /\?.*rpress[_-]?recover(y)? {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}