{"id":"CVE-2026-125784","kind":"vulnerability","aliases":["CVE-2026-125784"],"related":[],"title":"RestroPress WordPress plugin: cross-site request forgery through version 3.4.11","description":"Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request Forgery.This issue affects RestroPress: from n/a through 3.4.11.","summary":"RestroPress, a WordPress restaurant ordering plugin by Magnigenie, has a cross-site request forgery flaw in versions through 3.4.11. An attacker can trick a logged-in administrator's browser into sending unwanted requests to the site.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"restropress","fixed":[],"affected":"<= 3.4.11","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["csrf","other","restropress","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, or run: wp plugin get restropress --field=version. Versions <= 3.4.11 are in the affected range. 3.5.0 and 3.5.0.1 are not listed as affected, but no source confirms they fix it.","fix":"No fixed version confirmed. The vendor changelog does not mention this CSRF. Latest release is 3.5.0.1 (2026-11-11); update to it and re-check Patchstack/NVD for the fixed version.","status":"open","published_at":"2026-11-11T12:19:50+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","triaged_at":"2026-11-11T12:28:25+00:00","updated_at":"2026-11-11T12:29:50+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T12:28:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"RestroPress WordPress plugin: cross-site request forgery through version 3.4.11","impact":"medium","summary":"RestroPress, a WordPress restaurant ordering plugin by Magnigenie, has a cross-site request forgery flaw in versions through 3.4.11. An attacker can trick a logged-in administrator's browser into sending unwanted requests to the site.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","restropress"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Forged requests change site settings or data under a logged-in user's session.","analyst_note":"Confirm fixed version and affected functions from the NVD entry or the vendor advisory; sources give no fix version.","how_to_check":"- Check the installed RestroPress plugin version in the WordPress admin under Plugins.\n- Compare it with the affected range: all versions through `3.4.11`.","plain_action":"","product_name":"restropress","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the RestroPress WordPress plugin at version 3.4.11 or earlier are affected. The sources do not say which roles or settings are required to trigger the request forgery.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000706,"input_tokens":4538,"output_tokens":504,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm fixed version and affected functions from the NVD entry or the vendor advisory; sources give no fix version.","search":"'-125784':14A,17A '-2026':13A,16A '3.4.11':11A,45B,86C 'administr':54B 'affect':81C 'allow':75C 'attack':47B 'browser':56B 'cross':5A,37B,65C,76C 'cross-sit':4A,36B,64C 'csrf':19B,69C 'cve':12A,15A 'flaw':41B 'forgeri':8A,40B,68C 'forgery.this':79C 'issu':80C 'log':52B 'logged-in':51B 'magnigeni':33B,72C 'n/a':84C 'order':30B 'plugin':3A,25B,31B 'request':7A,39B,60B,67C,78C 'restaur':29B 'restropress':1A,18A,21B,26B,73C,74C,82C 'send':58B 'site':6A,38B,63B,66C,77C 'trick':49B 'unwant':59B 'version':10A,43B 'vulner':70C 'wordpress':2A,22B,24B,28B 'wordpress-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the RestroPress WordPress plugin at version 3.4.11 or earlier are affected. The sources do not say which roles or settings are required to trigger the request forgery.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["restropress"],"ptokens":["restropress"],"labels":["csrf","high","other","restropress","vendor","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-125784':14A,17A '-2026':13A,16A '3.4.11':11A 'cross':5A 'cross-sit':4A 'cve':12A,15A 'forgeri':8A 'plugin':3A 'request':7A 'restropress':1A,18A 'site':6A 'version':10A 'wordpress':2A","search_b":"'3.4.11':45B 'administr':54B 'attack':47B 'browser':56B 'cross':37B 'cross-sit':36B 'csrf':19B 'flaw':41B 'forgeri':40B 'log':52B 'logged-in':51B 'magnigeni':33B 'order':30B 'plugin':25B,31B 'request':39B,60B 'restaur':29B 'restropress':21B,26B 'send':58B 'site':38B,63B 'trick':49B 'unwant':59B 'version':43B 'wordpress':22B,24B,28B 'wordpress-plugin':23B","search_c":"'3.4.11':86C 'affect':81C 'allow':75C 'cross':65C,76C 'cross-sit':64C 'csrf':69C 'forgeri':68C 'forgery.this':79C 'issu':80C 'magnigeni':72C 'n/a':84C 'request':67C,78C 'restropress':73C,74C,82C 'site':66C,77C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125784","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125784","severity":null,"published_at":"2026-11-11T12:19:50+00:00","modified_at":"2026-11-11T12:19:50+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","fetched_at":"2026-11-11T12:27:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125784:3544","url":"https://patchstack.com/database/wordpress/plugin/restropress/vulnerabilities","severity":null,"published_at":"2026-11-11T12:29:50+00:00","modified_at":"2026-11-11T12:29:50+00:00","first_seen_at":"2026-11-11T12:29:50+00:00","fetched_at":"2026-11-11T12:29:50+00:00","note":"Patchstack (CVSS audit@patchstack.com) lists CSRF <= 3.4.11, published today. No source names the fixed version or function. Vendor changelog: 3.5.0.1 (2026-11-11) is latest, but it lists no CSRF fix, so upgrade to latest is advice, not a confirmed fix. Nothing verified; no exploitation or PoC found.","cites":["https://patchstack.com/database/wordpress/plugin/restropress/vulnerabilities","https://www.restropress.com/changelog/"]}],"documents":[{"id":125442,"url":"https://patchstack.com/database/wordpress/plugin/restropress/vulnerabilities","title":"RestroPress vulnerabilities - Patchstack (CSRF <= 3.4.11)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":125443,"url":"https://www.restropress.com/changelog/","title":"RestroPress changelog (3.5.0.1 released 2026-11-11)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}