Description

The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-21T09:17:05.920Z",
  "pubdate": "2026-09-21T09:17:05.920Z",
  "executiveSummary": "The RestroPress WordPress plugin, in versions prior to 3.4.6, is susceptible to an Insecure Direct Object Reference (IDOR) and improper input validation vulnerability involving item add-on pricing.\nThe vulnerability stems from the plugin's failure to perform server-side validation on price data transmitted via client-side requests during cart updates or item additions.\nAn unauthenticated remote attacker can intercept and modify HTTP requests to inject arbitrary, malicious pricing values for product add-ons.\nThis flaw allows attackers to manipulate the final checkout total, enabling the purchase of items at significantly reduced costs or effectively zero-cost, resulting in direct financial loss for the merchant.\nBecause the server trusts the price sent by the client without cross-referencing it against the authoritative database record, the integrity of the transaction process is fundamentally compromised.\nThe risk is categorized as critical due to the ease of exploitation, which requires no specialized privileges, and the direct impact on revenue and business logic.",
  "technicalDetails": "The root cause of this vulnerability is the lack of server-side state verification for cart add-on pricing within the RestroPress plugin. When a user interacts with the cart—specifically when adding or updating items—the client application sends an AJAX request containing product and add-on information to the server.\nThe server-side component responsible for processing these requests fails to sanitize or validate the 'price' parameter against the actual price defined in the WordPress database.\nDuring the exploitation process, an attacker can utilize an intercepting proxy, such as Burp Suite or OWASP ZAP, to capture the outgoing request destined for the RestroPress cart management endpoint.\nThe attacker modifies the payload by injecting a lower value (or zero) into the price field associated with the requested add-ons. Upon receiving the modified request, the server processes the data and updates the user's session-based cart total based exclusively on the tainted input provided by the client.\nWhen the attacker proceeds to the checkout phase, the payment gateway receives the manipulated total. Because the server-side logic never re-verified the individual component prices, the order is successfully finalized with the attacker-defined price.\nThis vulnerability is classified as an improper input validation flaw that bypasses business logic. It does not require administrative access, existing user credentials, or any specific authentication, as the cart update functionality is exposed to public-facing traffic.\nThe impact of this exploit is severe, as it facilitates financial fraud by allowing unauthorized modification of transaction totals. It effectively bypasses the pricing engine, rendering any promotional or standard pricing configurations moot.\nThe flaw affects all RestroPress installations using versions prior to 3.4.6. The exploitation occurs entirely over the network via standard HTTP/HTTPS protocols, making it accessible to any user capable of interacting with the plugin's cart interface."
}