/Vulnerability Library

RestroPress 3.0.0-3.2.1 - Authentication Bypass

CVE-2025-9209
Verified

Description

RestroPress Online Food Ordering System WordPress plugin 3.0.0 to 3.1.9.2 contains an authentication bypass caused by exposure of user private tokens and API data via /wp-json/wp/v2/users endpoint, letting unauthenticated attackers forge JWT tokens and authenticate as other users including administrators, exploit requires no authentication.

Severity

Critical

CVSS Score

9.8

Exploit Probability

2%

Published Date

April 22, 2026

Template Author

0x_akoko

CVE-2025-9209.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2025-9209
CWE ID:
cwe-287

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/restropress/restropress-online-food-ordering-system-300-3192-unauthenticated-information-exposure-to-authentication-bypass-via-forged-jwthttps://nvd.nist.gov/vuln/detail/CVE-2025-9209

Remediation Steps

Update to the latest version beyond 3.1.9.2.