EUVD-2026-54993
GHSA-q4j7-5cq8-7g9h
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Network-accessible REST API requires administrator credentials (PR:H); scope changed because SQL injection reaches the underlying database beyond WordPress's boundary; no integrity or availability impact described.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.
AnalysisAI
SQL injection in the vitepos WordPress plugin before version 3.6.0 enables authenticated administrators to exfiltrate database contents via a crafted REST API report request. The vulnerability stems from an unsanitized identifier taken directly from the request body and concatenated into a SQL query, a textbook CWE-89 flaw. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete conditions: first, the vitepos WordPress plugin must be installed and active in a version prior to 3.6.0; second, the attacker must authenticate to WordPress with a valid administrator-level account (PR:H - subscriber, contributor, author, or editor roles are insufficient); third, the WordPress REST API must be reachable over the network, which is the default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 4.1 accurately reflects the constrained threat model: the high privilege requirement (PR:H) and limited confidentiality impact (C:L) substantially reduce real-world risk compared to a typical unauthenticated SQL injection. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained WordPress administrator credentials - via credential stuffing against a reused password, a phishing campaign, or lateral movement from a previously compromised service - sends a crafted REST API POST request to the vitepos report endpoint, embedding a malicious SQL fragment in the identifier field of the JSON body. The plugin passes this value directly into the database query, allowing the attacker to enumerate tables, extract user records including hashed passwords, and potentially access data from other schemas on the same database server. … |
| Remediation | The primary fix is to update the vitepos WordPress plugin to version 3.6.0 or later, which is confirmed available from the vendor and resolves the SQL injection by properly sanitizing and parameterizing the affected identifier before database use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in the Vitepos WordPress point-of-sale plugin before 3.4.2 lets an authenticated user holding a cus
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager rol
Blind SQL injection in the appsbd Vitepos (vitepos-lite) WordPress point-of-sale plugin affects all versions up to and i
Unauthenticated sensitive data exposure in the Vitepos WordPress plugin (versions 3.4.2 and earlier) lets remote attacke
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today