CyberRota Analysis
AI-GeneratedThe Restaurant Menu and Food Ordering WordPress plugin versions prior to 2.4.12 are vulnerable to a lack of verification for PayPal payment notifications, enabling unauthenticated attackers to spoof payment confirmations. This could lead to unauthorized order completions and financial losses for businesses relying on the plugin for transactions. WordPress site administrators using this plugin should prioritize applying the update to mitigate potential exploitation.
Original NVD Description
The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment.