Executive brief
RestroPress is a WordPress plugin for restaurant ordering and payment processing. The plugin fails to verify that a customer owns an order before allowing payment recovery operations, permitting unauthenticated attackers to discover which orders exist and add unauthorized notes to other customers' orders. This can expose customer information and enable order tampering.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the payment-recovery flow. The plugin does not verify order ownership before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate orders in a recoverable state and write notes to arbitrary orders. The vulnerability requires network access to the WordPress plugin endpoints and does not require authentication or user interaction. An attacker can discover active orders and modify order metadata by directly referencing order identifiers. The vulnerability is fixed in version 3.4.8.
Affected products
- RestroPress RestroPress through 3.4.6
Timeline
- 2026-09-16: disclosed
- 2026-09-18: patched: Fixed in version 3.4.8