Loading vulnerability…
Authentication Bypass via JWT Forgery in RestroPress for WordPress
CVE-2025-9209 is an authentication bypass vulnerability affecting the RestroPress – Online Food Ordering System plugin for WordPress in versions 3.0.0 through 3.1.9.2. The issue arises because the plugin exposes sensitive user private tokens and related API data through the publicly accessible /wp-json/wp/v2/users REST API endpoint. Due to insufficient restriction of sensitive user meta fields in REST responses, unauthenticated attackers can enumerate users and retrieve token material that should not be disclosed. With this exposed data, an attacker can forge valid JSON Web Tokens for arbitrary accounts, including administrator accounts, and then authenticate as those users.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthenticated attackers to bypass authentication and impersonate arbitrary users, including administrators. In practice, this can lead to full administrative access to the affected WordPress site, enabling complete compromise of site content, plugin and theme management, user administration, and any other actions available to the impersonated account.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict unauthenticated access to the WordPress REST API, particularly the /wp-json/wp/v2/users endpoint, and review whether user enumeration and user meta exposure are possible in the current deployment. Monitor for suspicious authentication activity involving forged or unexpected JWT-based sessions, and rotate any exposed token material if feasible. These are temporary risk-reduction measures and do not replace upgrading to a fixed version.
Patch, then assume compromise.
Update the RestroPress plugin to a version newer than 3.1.9.2, as the vulnerable range is 3.0.0 through 3.1.9.2. The underlying issue must be fixed by preventing exposure of private user tokens and related sensitive API data via the WordPress REST API, especially the /wp-json/wp/v2/users endpoint.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.