CVE-2026-85010 — RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing u…
Published: 2026-09-21 · CVSS: 5.3 · CVSS 3.1
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7