CVE-2026-85010 in RestroPress Plugin
Summary
by MITRE • 09/21/2026
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in RestroPress versions prior to 3.4.6 represents a critical server-side logic flaw within the plugin's shopping cart functionality. This specific weakness stems from a failure to perform adequate input validation on client-supplied data during the process of adding or updating items in the user's cart. In secure web application design, any financial value transmitted by the client must be treated as untrusted and verified against authoritative server-side records before being processed for order placement. The RestroPress plugin fails this fundamental security principle by accepting the price parameter directly from the HTTP request without cross-referencing it with the actual product pricing stored in the database or application logic. This architectural oversight allows an attacker to manipulate the transaction flow at a low level, bypassing intended business rules and financial controls entirely.
From a technical perspective, this flaw is classified under CWE-20 Improper Input Validation, specifically manifesting as CWE-840 Incorrect Calculation of Business Logic Error. The vulnerability exploits the trust relationship between the frontend interface and the backend processing engine. When an unauthenticated user interacts with the cart endpoint, they can inject arbitrary numerical values into the item add-on price field. Because the server does not validate that this submitted value matches the legitimate price defined for that specific menu item or addon, it proceeds to calculate the total order cost based on the manipulated input. This allows for precise control over the final transaction amount, enabling scenarios where an attacker can set prices significantly below market value or even reduce them to zero effectively obtaining goods without payment.
The operational impact of this vulnerability is severe from both a financial and reputational standpoint. Unauthenticated attackers can exploit this flaw to place orders with arbitrary totals, including zero-cost transactions. This capability facilitates direct economic loss for the business through unpaid orders and potential inventory depletion if the system automatically processes such requests. Furthermore, it undermines the integrity of sales reporting and revenue tracking systems, as fraudulent entries will appear in transaction logs despite lacking valid payment authorization. The ability to place orders without authentication also suggests that other cart-related functionalities may be susceptible to similar manipulation, potentially allowing for abuse beyond just price alteration, such as adding unlimited quantities or manipulating shipping costs if those fields are similarly unvalidated.
This type of vulnerability aligns with the MITRE ATT&CK technique T1059 Command and Scripting Interpreter in contexts where automated scripts might exploit this flaw at scale, but more accurately maps to TA0004 Impact tactics involving Data Manipulation or Resource Theft. The lack of authentication requirement for exploitation lowers the barrier to entry significantly, allowing any internet user with basic web interaction tools to conduct attacks without needing valid credentials. This increases the likelihood of widespread automated scanning and exploitation attempts against sites running vulnerable versions of RestroPress.
Mitigation requires immediate action by site administrators to update the RestroPress plugin to version 3.4.6 or later, where this validation logic has been corrected. In addition to updating software, developers should implement robust server-side validation for all financial inputs in future development cycles. This includes ensuring that prices are always retrieved from a trusted source such as the database rather than relying on client-supplied values. Implementing strict input sanitization and type checking can further reduce the risk of similar logic flaws. Security testing procedures should also be enhanced to include business logic validation, specifically targeting scenarios where price manipulation or cart tampering could occur during integration tests.