A missing authorization check in the Magnigenie RestroPress WordPress plugin lets attackers perform actions beyond their granted permissions. This CWE‑862 flaw can give unauthorized access to the plugin’s administrative features, potentially exposing or altering restaurant menus, orders, and backend settings. The flaw is exploitable because the plugin accepts requests without verifying the requester’s permissions, allowing a threat actor to impersonate an authorized user.

WordPress sites that use the Magnigenie RestroPress plugin with versions up to and including 3.2.3.5 are vulnerable. Any installation running the plugin 3.2.3.5 or earlier, regardless of the WordPress core version, may be affected.

The CVSS score of 6.5 indicates moderate risk, and the EPSS figure of less than 1% points to a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to send crafted HTTP requests to plugin endpoints that lack proper permission checks. If the plugin allows privileged functions via these endpoints, a non‑authenticated or low‑privilege user could gain elevated access to data or configuration settings. The likely attack vector is inferred to be via HTTP requests to exposed plugin endpoints, although the description does not explicitly confirm this.