Loading vulnerability…
CVE-2025-9209 is an authentication bypass vulnerability affecting the RestroPress – Online Food Ordering System plugin for WordPress in versions 3.0.0 through 3.1.9.2. The issue arises because the plugin exposes sensitive user private tokens and related API data through the publicly accessible /wp-json/wp/v2/users REST API endpoint. Due to insufficient restriction of sensitive user meta fields in REST responses, unauthenticated attackers can enumerate users and retrieve token material that should not be disclosed. With this exposed data, an attacker can forge valid JSON Web Tokens for arbitrary accounts, including administrator accounts, and then authenticate as those users.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Python exploit script (CVE-2025-9209.py) targeting a critical unauthenticated information exposure vulnerability (CVE-2025-9209) in the RestroPress WordPress plugin (versions 3.0.0 to 3.1.9.2). The exploit automates mass scanning and exploitation of multiple WordPress sites, extracting sensitive user credentials (private/public keys, JWT tokens, API keys) from the vulnerable /wp-json/rp/v1/customers API endpoint. The script is multi-threaded, supports robust error handling, and outputs results to structured files for further analysis or exploitation. The README provides clear usage instructions and describes the vulnerability's impact (full account takeover). No framework is used; the code is standalone Python. The repository is well-structured, with a single main exploit file, a README, a license, and a requirements file.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An authentication bypass vulnerability in the RestroPress plugin caused by JWT forgery, allowing unauthenticated attackers to log in as arbitrary users including administrators.
An authentication bypass vulnerability in the RestroPress WordPress plugin caused by exposure of sensitive user tokens through a public REST API endpoint, allowing attackers to forge JWTs and gain administrative access.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.