CVE-2026-84044

Medium · 5.3

CVSS

5.3

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

The record

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment.

Affected packages

Ecosystem	Package	Introduced	Fixed