CVE-2026-85010

Summary

The flaw allows unauthenticated users to manipulate item prices in the RestroPress WordPress plugin, potentially placing orders with arbitrary totals or zero value.

Exploitability

Exploitation is relatively easy as it requires no authentication and can be done by any user with access to the affected plugin's functionality.

Blast radius

If exploited, this could lead to significant financial loss through fraudulent orders or unauthorized price setting in a restaurant or food service business using the plugin.

Prioritized remediation

Update to RestroPress version 3.4.6 or later to validate client-supplied prices on the server side.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.