CVE-2026-84044
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Sep 04, 2026
Vendor
unknown
Description
The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment.