Restaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Forged Payment Completion

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Payment Bypass in all versions up to 2.4.12. This is due to a broken conditional in the IPN verification logic that used AND instead of OR, combined with a re-check of the disable_paypal_verification option, causing verification to never reject a non-VERIFIED response when the option was false (the default), and the presence of a disable_paypal_verification setting that could entirely bypass the check. This makes it possible for unauthenticated attackers to mark arbitrary orders as paid and completed without making any actual payment by sending a forged PayPal IPN notification.

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Restaurant Menu and Food Ordering 2.4.12 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts