PT-2025-40490 · WordPress · Restropress – Online Food Ordering System

Kenneth Dunn · Published 2025-10-03 · Updated 2026-04-23 · CVE-2025-9209

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RestroPress – Online Food Ordering System plugin for WordPress versions 3.0.0 through 3.1.9.2

Description The RestroPress plugin for WordPress is affected by an authentication bypass issue. The plugin exposes user private tokens and API data through the /wp-json/wp/v2/users API endpoint. This allows unauthenticated attackers to forge JSON Web Tokens (JWT) for other users, including administrators, and authenticate as them. The user private tokens are exposed, enabling JWT forgery.

Recommendations Update to a version later than 3.1.9.2.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-9209

Affected Products

Restropress – Online Food Ordering System

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-9209 · Security Note
• https://twitter.com/pdnuclei_bot/status/2047359878445109498 · Twitter Post
• https://twitter.com/cracbot/status/1975878899444711916 · Twitter Post
• https://twitter.com/CveFindCom/status/1974077777549697265 · Twitter Post
• https://twitter.com/0dayPublishing/status/1974076745549574390 · Twitter Post
• https://wordpress.org/plugins/restropress · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/359833dd-de3c-48ea-8eef-06588a590da2?source=cve · Note