CVE-2026-85010 Overview
CVE-2026-85010 affects the RestroPress WordPress plugin in versions prior to 3.4.6. The plugin fails to validate a client-supplied item add-on price on the server side when items are added to or updated in the cart. Unauthenticated attackers can submit arbitrary prices and place orders for any total, including zero. The flaw is categorized under CWE-472: External Control of Assumed-Immutable Web Parameter and represents a business logic error common to e-commerce plugins.
Critical Impact
Unauthenticated attackers can place restaurant orders at attacker-chosen prices, resulting in direct financial loss for site operators.
Affected Products
- RestroPress WordPress plugin versions prior to 3.4.6
- WordPress sites using RestroPress for online food ordering
- Restaurant and hospitality sites relying on RestroPress add-on pricing
Discovery Timeline
- 2026-09-21 - CVE-2026-85010 published to the National Vulnerability Database
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-85010
Vulnerability Analysis
RestroPress accepts add-on price values from the client when items are added to or updated in the cart. The plugin trusts these values without re-checking them against the authoritative price stored on the server. An unauthenticated user can intercept the cart request and substitute the add-on price field with an arbitrary numeric value.
The request flow requires no authentication, no user interaction, and only network access to the target site. Attackers place orders through the standard checkout process using manipulated totals. The impact is limited to integrity of order data and revenue loss; confidentiality and availability are not directly affected.
Root Cause
The root cause is a missing server-side validation control. The plugin treats the add-on price parameter as trusted input rather than recalculating it from stored product data. This violates the principle that any value influencing financial calculations must be derived from server-side state, not accepted from the client.
Attack Vector
An attacker browses to a RestroPress-enabled site and adds an item with add-ons to the cart. Using a proxy or browser developer tools, the attacker modifies the add-on price field in the cart AJAX request. The server accepts the modified price and updates the cart total accordingly. The attacker completes checkout at the manipulated total, which may be reduced to zero.
Because no authentication is required, exploitation can be automated at scale. Refer to the WPScan Vulnerability Report for additional technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-85010
Indicators of Compromise
- Orders in the RestroPress order log with unusually low totals or zero-value line items containing paid add-ons
- Cart AJAX requests where the submitted add-on price does not match the product configuration in the WordPress admin
- Repeated checkout activity from a single IP address producing anomalously low order totals
Detection Strategies
- Compare each completed order's add-on charges against the current add-on price defined in the RestroPress product configuration
- Alert on any order where the calculated server-side total differs from the recorded order total
- Review web server access logs for POST requests to RestroPress cart endpoints followed by successful low-value checkouts
Monitoring Recommendations
- Enable verbose logging on WordPress AJAX endpoints handling restropress cart actions
- Forward WordPress and web server logs to a centralized analytics platform for correlation and anomaly detection
- Establish a baseline for average order value and add-on revenue, then alert on deviations
How to Mitigate CVE-2026-85010
Immediate Actions Required
- Upgrade RestroPress to version 3.4.6 or later on all WordPress installations
- Audit completed orders since the plugin was installed for evidence of manipulated pricing
- Reconcile order totals against the RestroPress add-on price catalog and issue chargebacks or cancellations where appropriate
Patch Information
The vendor addressed CVE-2026-85010 in RestroPress version 3.4.6. The fix introduces server-side validation of add-on prices during cart add and update operations. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict access to the RestroPress checkout endpoints using a web application firewall rule that inspects cart parameters for tampering
- Temporarily disable add-ons on RestroPress products until the plugin is updated
- Enable manual order review before payment capture, allowing staff to catch pricing anomalies before fulfillment
# Update RestroPress via WP-CLI
wp plugin update restropress --version=3.4.6
wp plugin get restropress --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
