s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

CVE-2026-85010

📛 CVE Title

RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons

⬇ Download JSON

Description

The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.

Overview

State
PUBLISHED
Assigner (CNA)
WPScan
CVSS severity
MEDIUM
CVSS score
CVSS 5.3 / 10 5.3 5.3 / 10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Effective score
5.3 / 10 MEDIUM source: CNA overview
CWE(s)
CWE-472 External Control of Assumed-Immutable Web Parameter
Reserved
2026-09-02
Published
2026-09-21 08:51 UTC
Last updated
2026-09-21 14:31 UTC
Source
https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85010.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published
2026-09-21 09:17:05 UTC
NVD last modified
2026-09-21 15:17:32 UTC
NVD CVSS v3.1
CVSS 5.3 / 10 5.3 5.3 / 10 MEDIUM source: contact@wpscan.com
NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability subscore
3.9 / 10
Impact subscore
1.4 / 10
EPSS score
0.0019 (probability of exploitation in next 30 days)
EPSS percentile
9.35% vs all CVEs — higher = more likely to be exploited, as of 2026-09-21

NVD-assigned CWE(s): CWE-472 (differs from the CNA list above)

NVD / KEV / EPSS data refreshed 2026-09-22 03:35 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2026-83867
Assigner
WPScan
Published
Sep 21, 2026, 8:51:51 AM
Updated
Sep 21, 2026, 2:31:14 PM
EUVD base score (CVSS 3.1)
5.3 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EUVD-reported EPSS
0.1900
Vendors
Unknown
Products
RestroPress (0 <3.4.6)
Aliases
GHSA-xf2r-mj9x-vg5q

ENISA description: The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.

EUVD references (1)

Affected products (1)
VendorProductVersionsPlatforms
Unknown RestroPress 0 (affected) —

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (1)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

Remediations (10)

  • Oracle Security Critical Patch Update (CSPU) August 2026 for Oracle Java SE
    web:docs.oracle.com

    Oracle Security Critical Patch Update (CSPU) August 2026 for Oracle Java SE Services: Java Management Release Date: August 18, 2026 Java Management supports the following releases that are part of the Oracle Security Critical Patch Update (CSPU) August 2026 for Oracle Java SE:

    2026-09-22 17:08 UTC
  • Pennsylvania Access To Criminal History - Home - pa
    web:epatch.pa.gov

    Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...

    2026-09-22 17:08 UTC
  • Patch - Everything Local: Breaking News, Events, Discussions
    web:patch.com

    The best breaking news, stories, and events from the Patch network of local news sites

    2026-09-22 17:08 UTC
  • Homewood-Flossmoor News, Breaking News in Homewood-Flossmoor, IL - Patch
    web:patch.com

    Homewood-Flossmoor Latest Headlines: Flossmoor's OAKtoberfest Offers Chance To Unplug And Reconnect With Nature; Heather Hill Students Celebrate The Joy Of Reading With Author John Schu; Why Your ...

    2026-09-22 17:08 UTC
  • Patch Tuesday September 2026: CVE Analysis | Automox
    web:www.automox.com

    September 2026 Patch Tuesday ships a record 973 CVEs , led by two exploited elevation of privilege bugs in the Windows Update Stack and ALPC. Plus unauthenticated RCE in DNS and Remote Desktop Services, a SQL Copilot read-only bypass, and an Outlook Reading Pane RCE.

    2026-09-22 17:08 UTC
  • Home - The Patch Augusta Municipal Golf Course
    web:www.golfthepatch.com

    Now open, The Patch features a redesigned 18-hole course, led by golf course architects Tom Fazio and Beau Welling, and a new 9-hole short course, The Loop at The Patch , designed by Tiger Woods and TGR Design. Welcome to Augusta's best-in-class public golf experience.

    2026-09-22 17:08 UTC
  • RDS Bug September 2026: Fix Windows Server Now
    web:www.it-connect.tech

    Fix the September 2026 RDS bug on Windows Server with Microsoft's KIR rollback. Learn deployment steps and keep the security update installed.

    2026-09-22 17:08 UTC
  • FIX Dictionary Reference - All Message Types : OnixS
    web:www.onixs.biz

    Easy to use online FIX messages and tag usage reference dictionary.

    2026-09-22 17:08 UTC
  • Oracle
    web:www.oracle.com

    Oracle Critical Security Patch Update Advisory - August 2026 Description. A Critical Security Patch Update (CSPU) provides targeted, high-priority security fixes in a smaller, mor

    2026-09-22 17:08 UTC
  • Microsoft admits Windows 11's emergency update still ... - Windows Latest
    web:www.windowslatest.com

    Windows 11's emergency update still breaks audio on some PCs, and it looks like a fix won't arrive until October 2026 Patch Tuesday, which is scheduled for October 13. On September 8 ...

    2026-09-22 17:08 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-85010.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85010",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T13:57:40.105520Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-472",
                "description": "CWE-472 External Control of Assumed-Immutable Web Parameter",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T14:31:14.227Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "RestroPress",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.4.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Usama Arshad"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-472 External Control of Assumed-Immutable Web Parameter",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T08:51:51.209Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/3ebcb11a-9f8c-48e3-8b1f-f91bb2518c34/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-85010",
    "datePublished": "2026-09-21T08:51:51.209Z",
    "dateReserved": "2026-09-02T18:44:51.359Z",
    "dateUpdated": "2026-09-21T14:31:14.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}