CVE-2026-85010

Name of the Vulnerable Software and Affected Versions RestroPress WordPress plugin versions prior to 3.4.6

Description Insufficient server-side validation of client-supplied item add-on prices occurs when items are added to or updated in the cart. This allows unauthenticated users to manipulate the price of add-ons, enabling them to place orders with an arbitrary total, including zero.

Recommendations Update RestroPress WordPress plugin to version 3.4.6 or later.