CVE-2026-84044: 
WordPress vulnerability analysis and mitigation

CVE-2026-84044 is an unauthenticated payment bypass vulnerability in the Restaurant Menu and Food Ordering WordPress plugin (by MotoPress) affecting all versions before 2.4.12. The flaw allows unauthenticated attackers to forge PayPal Instant Payment Notification (IPN) messages, causing the plugin to mark an unpaid order as paid and completed without any real transaction occurring. It was publicly disclosed on September 2, 2026, and published to the NVD on September 4, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (WPScan, GitHub Advisory).

The root cause is insufficient verification of data authenticity (CWE-345): the plugin's PayPal IPN listener endpoint (?mprm-listener=IPN) processes incoming payment notifications without performing the required PayPal IPN validation postback — the step that confirms a notification genuinely originated from PayPal. An attacker who has placed an order (obtaining the order ID, purchase key/invoice, order total, currency, and merchant PayPal email — all of which are publicly visible in the checkout flow) can craft a forged HTTP POST to the listener with payment_status=Completed and matching order metadata. Because the plugin never validates the IPN with PayPal's servers, it accepts the forged notification and transitions the order to a paid/completed state, recording the attacker-supplied transaction ID. No authentication, cookies, or nonce are required (WPScan).

Successful exploitation allows an unauthenticated attacker to obtain goods or services from a WordPress-based food ordering site without making any payment, directly causing financial/revenue loss to the merchant. The integrity impact is limited to order status manipulation — there is no confidentiality breach or availability impact. The attack is automatable and scalable, meaning a single attacker could fraudulently complete multiple orders in rapid succession (WPScan, GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). However, WPScan's advisory includes a detailed step-by-step PoC demonstrating the attack using a single curl command, making the barrier to exploitation very low for anyone who reads the advisory. The EPSS score is approximately 0.117% (2nd percentile), indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, and no threat actor attribution has been reported (WPScan).

1. Reconnaissance: Identify WordPress sites running the Restaurant Menu and Food Ordering plugin (mp-restaurant-menu) with PayPal Standard gateway enabled. This can be done via passive enumeration (e.g., checking plugin directories or storefront source for PayPal button fields).
2. Place a legitimate order: As an unauthenticated visitor, add items to the cart and proceed to checkout, selecting PayPal as the payment method. Do not complete payment. Note the order ID, purchase key (invoice), order total, store currency, and merchant PayPal email (visible in the PayPal redirect button's business field).
3. Craft a forged IPN request: Construct an HTTP POST to the plugin's IPN listener endpoint with the collected order details and a fabricated transaction ID:

curl -sk -X POST 'https://victim.example/index.php?mprm-listener=IPN' \
  --data-urlencode 'txn_type=web_accept' \
  --data-urlencode 'payment_status=Completed' \
  --data-urlencode 'mc_gross=<order_total>' \
  --data-urlencode 'mc_currency=<currency>' \
  --data-urlencode 'business=<merchant_paypal_email>' \
  --data-urlencode 'invoice=<purchase_key>' \
  --data-urlencode 'custom=<order_id>' \
  --data-urlencode 'txn_id=FORGED-0001' \
  --data-urlencode 'item_number=<order_id>'

4. Order marked as paid: The plugin processes the forged IPN without validating it against PayPal's servers, transitions the order from pending to completed, records the fake transaction ID, and sends a receipt — all without any real payment (WPScan).

• Network: Unexpected HTTP POST requests to /?mprm-listener=IPN (or equivalent) originating from IP addresses not associated with PayPal's known IPN sender ranges; requests lacking standard PayPal headers or originating from non-PayPal ASNs.
• Logs: WordPress/web server access logs showing POST requests to the IPN listener endpoint with payment_status=Completed and txn_id values that do not appear in PayPal transaction records; multiple IPN posts for the same order ID in a short timeframe.
• Application Data: Orders in the plugin's database transitioning from pending to completed/paid status with transaction IDs that cannot be verified in the merchant's PayPal account dashboard; receipt emails sent for orders with no corresponding PayPal payment record.
• Pattern: Repeated IPN submissions with sequential or obviously fabricated txn_id values (e.g., FORGED-0001, TEST-TXN-123) (WPScan).

Update the Restaurant Menu and Food Ordering WordPress plugin to version 2.4.12 or later, which addresses the missing IPN verification. As a defense-in-depth measure, site owners should implement server-side PayPal IPN validation by posting received notifications back to PayPal's IPN verification endpoint (https://ipnpb.paypal.com/cgi-bin/webscr) and only processing orders when PayPal returns VERIFIED. Additionally, merchants should cross-reference completed orders against their PayPal transaction history and consider temporarily disabling the PayPal Standard gateway until the patch is applied (WPScan, GitHub Advisory).

The vulnerability was discovered and responsibly reported by researcher Muni Nitish Kumar Yaddala and verified by WPScan. A threat intelligence alert was published by Brinztech characterizing it as a critical payment bypass issue. No major vendor statements or widespread social media discussion have been observed beyond standard vulnerability database aggregation (WPScan).