WordPress plugin
RestroPress – Online Food Ordering System security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 13 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High1
- Medium11
- Low0
All RestroPress – Online Food Ordering System vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Cross-Site Request Forgery ≤3.4.11Update to 3.5.0 | CVE-2026-125784 | |
| Medium5.3 | Unauthenticated Payment Bypass ≤3.4.5Update to 3.4.6 | CVE-2026-85010 | |
| Medium5.3 | Unauthenticated Insecure Direct Object Reference <3.4.8Update to 3.4.8 | CVE-2026-85009 | |
| Medium5.3 | Missing Authorization ≤3.2.7Update to 3.2.8 | CVE-2025-62129 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤3.2.8.6Update to 3.2.8.6.1 | CVE-2025-69017 | |
| Medium4.3 | Missing Authorization ≤3.2.3.5Update to 3.2.3.6 | CVE-2025-66100 | |
| Critical9.8 | 3.2.1 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT 3.0.0 – 3.2.1Update to 3.2.2 | CVE-2025-9209 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤3.2.8.6Update to 3.2.8.6.1 | CVE-2025-32553 | |
| Medium4.3 | Missing Authorization ≤3.2.8Update to 3.2.8.1 | CVE-2025-31877 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤3.1.2.1Update to 3.1.2.2 | CVE-2024-35719 | |
| Medium4.3 | Cross-Site Request Forgery via rpress_orders_list_table_process_bulk_actions ≤3.1.2Update to 3.1.2.1 | CVE-2024-32449 | |
| High8.8 | Cross-Site Request Forgery to Cart Manipulation ≤2.8.2Update to 2.8.3 | — | |
| Medium5.4 | Missing Authorization ≤2.8.3Update to 2.8.3.1 | — |
- Medium4.3Cross-Site Request Forgery
≤3.4.11Update to 3.5.0
- Medium5.3Unauthenticated Payment Bypass
≤3.4.5Update to 3.4.6
- Medium5.3Unauthenticated Insecure Direct Object Reference
<3.4.8Update to 3.4.8
- Medium5.3Missing Authorization
≤3.2.7Update to 3.2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.2.8.6Update to 3.2.8.6.1
- Medium4.3Missing Authorization
≤3.2.3.5Update to 3.2.3.6
- Critical9.83.2.1 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT
3.0.0 – 3.2.1Update to 3.2.2
- Medium6.1Reflected Cross-Site Scripting
≤3.2.8.6Update to 3.2.8.6.1
- Medium4.3Missing Authorization
≤3.2.8Update to 3.2.8.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.1.2.1Update to 3.1.2.2
- Medium4.3Cross-Site Request Forgery via rpress_orders_list_table_process_bulk_actions
≤3.1.2Update to 3.1.2.1
- High8.8Cross-Site Request Forgery to Cart Manipulation
≤2.8.2Update to 2.8.3
- Medium5.4Missing Authorization
≤2.8.3Update to 2.8.3.1
RestroPress – Online Food Ordering System: common questions
Does RestroPress – Online Food Ordering System have known vulnerabilities?
Yes. VulnCrest Radar lists 13 known vulnerabilities in RestroPress – Online Food Ordering System: 1 critical, 1 high, 11 medium. None are known to affect version null.
How do I check which version of RestroPress – Online Food Ordering System I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent RestroPress – Online Food Ordering System vulnerability?
CVE-2026-125784, published Nov 11, 2026: RestroPress – Online Food Ordering System <= 3.4.11 - Cross-Site Request Forgery. Severity: Medium (CVSS 4.3).
Is any RestroPress – Online Food Ordering System vulnerability listed in CISA KEV?
No. None of the known RestroPress – Online Food Ordering System vulnerabilities is currently listed in the CISA KEV catalog.