Description
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | RestroPress | ≤ 3.4.6 | — |
References
- https://wpscan.com/vulnerability/9731b0f3-76c2-4e0a-9630-9160299a37ee/ exploit vdb-entry technical-description