Is CVE-2026-85010 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85010?

CVE-2026-85010 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-85010

Description

The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.