CVE-2025-9209 Scanner
CVE-2025-9209 Scanner - Authentication Bypass vulnerability in RestroPress
Used 2.8k times · 3.4k assets checked · domain, subdomain, ipv4
CVE
CVE-2025-9209
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated attackers to forge JWT tokens for other users, including administrators, and authenticate as them.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
restropress – online food ordering system
Updated Oct 12, 2026View on NVD →
S4E scanner
CVE history: restropress – online food ordering system
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →