Introduction
Attackers can gain full administrative access to WordPress sites running vulnerable versions of RestroPress, a widely used online food ordering plugin. The plugin exposes sensitive authentication tokens through a public API endpoint, which lets an unauthenticated attacker access any user account, including administrators.
RestroPress is a WordPress plugin from Magnigenie that restaurants and food businesses use to manage online orders. It has over 124,000 downloads and more than 1,000 active installations. Most of its users are small to medium-sized businesses that rely on WordPress for e-commerce and customer engagement.
Technical information
CVE-2025-9209 comes from improper handling of sensitive user data in the RestroPress plugin for WordPress, versions 3.0.0 through 3.1.9.2. The plugin exposes private user tokens and API data through the /wp-json/wp/v2/users REST API endpoint, and WordPress lets unauthenticated users reach this endpoint by default.
The plugin does not adequately filter or restrict sensitive user meta fields when it responds to API requests. Attackers can therefore enumerate users and pull private tokens or cryptographic material straight from the API response. With those tokens, an attacker can forge valid JSON Web Tokens (JWTs) for any user, including users with administrative privileges. That bypasses all authentication controls and gives the attacker full access to the WordPress site.
The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The exposed authentication tokens are the direct root cause, and exploitation is straightforward because the affected API endpoint has no access controls.
Affected systems and versions
- Product: RestroPress – Online Food Ordering System plugin for WordPress
- Affected versions: 3.0.0 through 3.1.9.2
- Vulnerable configuration: Any WordPress installation with a vulnerable version of RestroPress enabled and the REST API accessible to unauthenticated users
Vendor security history
Magnigenie, the developer of RestroPress, has a documented history of security issues in this plugin. Previous vulnerabilities include:
- CVE-2024-35719: Authenticated stored cross-site scripting (XSS) in versions up to 3.1.2.1
- CVE-2024-32449: Cross-site request forgery (CSRF) in order processing
- Multiple missing authorization and input validation issues
The vendor has released patches in response to disclosures, but security problems keep recurring, which points to ongoing trouble with its secure development practices.
