https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 14:06:49 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-85009 <p>The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer&#39;s order.</p> <p>The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer&#39;s order.</p> https://db.gcve.eu/vuln/fkie_cve-2026-85009 https://db.gcve.eu/vuln/ghsa-v23v-8m6m-59wf <p>The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer&#39;s order.</p> <p>The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer&#39;s order.</p> https://db.gcve.eu/vuln/ghsa-v23v-8m6m-59wf