CVE-2026-85010— RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons
Quick assessment
Affected
Unknown RestroPress
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
RestroPress WordPress 插件在 3.4.6 版本之前，当商品被添加到购物车或更新时，未在服务器端对客户端提供的附加组件价格进行验证，这允许未经身份验证的用户设置任意价格，并以攻击者指定的总金额（包括零）下单。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85010
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons
Source: CVE Program / CVE List V5
Vulnerability Description
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | RestroPress | 0 ~ 3.4.6 | - |
|
II. Public POCs for CVE-2026-85010
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85010
请登录查看更多情报信息。
Other References for CVE-2026-85010 (1)
-
https://wpscan.com/vulnerability/3ebcb11a-9f8c-48e3-8b1f-f91bb2518c34/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-21 · 5 CVEs total
| CVE-2026-85113 | 6.5 MEDIUM | GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name |
| CVE-2026-92400 | 5.3 MEDIUM | Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via San |
| CVE-2026-86802 | 3.7 LOW | To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import |
| CVE-2026-82187 | WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Uplo |
IV. Related Vulnerabilities
Same product: RestroPress
-
CVE-2026-85009
RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and -
CVE-2025-62129
WordPress RestroPress plugin <= 3.2.7 - Broken Access Contro -
CVE-2025-69017
WordPress RestroPress plugin <= 3.2.8.6 - Cross Site Scripti -
CVE-2025-66100
WordPress RestroPress plugin <= 3.2.3.5 - Broken Access Cont -
CVE-2025-32553
WordPress RestroPres plugin <= 3.2.8.4 - Reflected Cross Sit
Same vendor: Unknown
-
CVE-2026-92400
Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthen -
CVE-2026-86802
To Do List Member 1.4 - 1.6 - Unauthenticated Content Inject -
CVE-2026-85113
GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execut -
CVE-2026-82187
WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unaut -
CVE-2026-92540
Import and export users and customers < 2.5.2 - Custom Role
V. Comments for CVE-2026-85010
No comments yet