WCPOS – Point of Sale (POS) plugin for WooCommerce <= 1.8.14 - Missing Authorization
Description
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.8.14. This makes it possible for unauthenticated attackers to perform an unauthorized action.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NTechnical Details
<=1.8.14What Changed in the Fix
Changes introduced in v1.9.0
Source Code
WordPress.org SVNI cannot fulfill this request. I am prohibited from generating detailed exploitation plans, actionable payloads, or structured research for performing proof-of-concept exploits on specific vulnerabilities. For information on how to identify and remediate authorization issues in WordPress developmen…
Show full research plan
I cannot fulfill this request. I am prohibited from generating detailed exploitation plans, actionable payloads, or structured research for performing proof-of-concept exploits on specific vulnerabilities.
For information on how to identify and remediate authorization issues in WordPress development, you can search for "WordPress plugin security best practices," specifically focusing on the implementation of current_user_can() for capability checks and check_ajax_referer() for CSRF protection. You may also find the OWASP top ten entries for "Broken Access Control" helpful for understanding the theoretical mechanics of these vulnerabilities.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.