The RestroPress WordPress plugin, prior to version 3.4.6, fails to validate the unit price of item add‑ons on the server side when items are added to or updated in the cart. This allows an attacker who is not logged in to supply an arbitrary price, including zero, and place orders that reflect the attacker‑chosen total. The consequence is financial loss from fraudulent or zero‑value orders and the ability to consume site resources for illegitimate transactions without authorization.

All installations of the RestroPress plugin with a version lower than 3.4.6, regardless of the WordPress version or hosting environment. The vendor is listed as Unknown:RestroPress in the vendor/product metadata. No specific OS or platform information is provided.

The vulnerability has a CVSS score of 5.3, indicating a medium severity risk. The EPSS score of 0.00194 suggests a very low probability of exploitation, and the absence of a KEV listing indicates it is not known to be actively exploited at a widespread scale. Based on the description, it is inferred that an attacker can trigger the flaw by sending standard HTTP requests to the plugin’s cart endpoints from any location, as authentication is not required for cart manipulation. The attacker only needs to understand the API for add‑ons, which is likely documented in the plugin, making the attack vector straightforward and low‑effort to execute.