RestroPress WordPress plugin: Cross-site request forgery
Summary
The RestroPress WordPress plugin up to and including version 3.4.11 is affected by a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). An attacker can craft a malicious web page that causes a logged-in user's browser to perform actions on the WordPress site without the user's intent. Exploitation requires the victim to be logged in and to visit a malicious link or page; the specific actions an attacker could force are not documented.
Affected
- RestroPress WordPress plugin, versions 0 through 3.4.11
- Versions from 3.5.0 are reported as unaffected (per CVE record and Patchstack)
Fixed in
- Update to RestroPress 3.5.0 or later
- Vendor advisory not found; confirm availability of 3.5.0 on WordPress.org before rollout
Workaround
Unknown. No vendor workaround is documented. General CSRF measures: limit administrator and shop-manager accounts, log out of the WordPress backend after use, and avoid browsing other sites in the same browser session.
Exploitation
- Not known to be exploited in the wild (per one aggregator)
- Not listed in CISA KEV
- No public proof-of-concept found so far
- Patchstack rates the issue as low priority and unlikely to be exploited
Our recommendation
- Inventory all WordPress sites running RestroPress, including extensions
- Update to version 3.5.0 or later once it is confirmed on WordPress.org
- Until then, reduce the number of administrator accounts and enforce logout and two-factor authentication for administrators
- Monitor the Patchstack entry and WordPress.org for changelog updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-125784 patchstack.com
- CVE Record CVE-2026-125784 www.cve.org
- Strix CVE-2026-125784 www.strix.ai
- OffSeq Radar CVE-2026-125784 radar.offseq.com
- WordPress.org RestroPress plugin page en-gb.wordpress.org
- Patchstack advisory CVE-2024-32449 (prior CSRF issue) patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:23.
Original description (NVD)
Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request Forgery.This issue affects RestroPress: from n/a through 3.4.11.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.