CVE-2026-84044
Restaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Payment Bypass via Forged PayPal IPN
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment.
| Vendor | unknown |
| Product | restaurant menu and food ordering |
| Published | Sep 4, 2026 |
| Last Updated | Sep 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown restaurant menu and food ordering
Be the first to know when new medium vulnerabilities affecting unknown restaurant menu and food ordering are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Restaurant Menu and Food Ordering
0 < 2.4.12
References
Credits
Muni Nitish Kumar Yaddala WPScan