CVE-2026-85009

Name of the Vulnerable Software and Affected Versions RestroPress versions prior to 3.4.7

Description The payment-recovery flow fails to verify ownership before processing a request-supplied order identifier. This allows unauthenticated attackers to identify which orders are in a recoverable state and add notes to orders belonging to other customers.

Recommendations Update to a version newer than 3.4.6.