What is the CVSS score of CVE-2026-4880?

CVE-2026-4880 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-4880?

Within 24 hours: Identify all WordPress installations using Barcode Scanner plugin ≤1.11.0 via plugin inventory and security scanning tools; disable or remove the affected plugin immediately if use is not critical. Within 7 days: Update to Barcode Scanner plugin version 1.11.1 or later (vendor patch deployed in changeset 3506824), verify update completion across all instances, and review WordPress admin user accounts for unauthorized changes or additional accounts created. Within 30 days: Conduct forensic review of access logs and database audit trails for indicators of compromise during the vulnerability window; reset all WordPress administrator credentials; review and restrict access to the WordPress REST API and admin interface; implement Web Application Firewall (WAF) rules to block malicious token requests to 'barcodeScannerConfigs' action.

Barcode Scanner Mobile App Inventory Manager Order Fulfillment System Pos Point Of Sale CVE-2026-4880

EUVD-2026-23136 CRITICAL

Improper Privilege Management (CWE-269)

2026-04-15 Wordfence

GHSA-p8x8-wgf2-jrjm

WordPress Privilege Escalation Barcode Scanner Mobile App Inventory Manager Order Fulfillment System Pos Point Of Sale Wordpress Plugin Ukrsolution

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 00:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 16, 2026 - 00:22 vuln.today

cvss_changed

Analysis Generated

Apr 16, 2026 - 00:20 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 23:45 euvd

EUVD-2026-23136

Analysis Generated

Apr 15, 2026 - 23:45 vuln.today

CVE Published

Apr 15, 2026 - 23:25 nvd

CRITICAL 9.8

DescriptionCVE.org

The Barcode Scanner (+Mobile App) - Inventory manager, Order fulfillment system, POS (Point of Sale) plugin for WordPress is vulnerable to privilege escalation via insecure token-based authentication in all versions up to, and including, 1.11.0. This is due to the plugin trusting a user-supplied Base64-encoded user ID in the token parameter to identify users, leaking valid authentication tokens through the 'barcodeScannerConfigs' action, and lacking meta-key restrictions on the 'setUserMeta' action. This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator by first spoofing the admin user ID to leak their authentication token, then using that token to update any user's 'wp_capabilities' meta to gain full administrative access.

AnalysisAI

Privilege escalation to WordPress administrator via insecure token-based authentication in Barcode Scanner (+Mobile App) plugin versions ≤1.11.0 allows remote unauthenticated attackers to gain full administrative control. The plugin leaks valid admin authentication tokens through the 'barcodeScannerConfigs' action and accepts Base64-encoded user IDs without validation, enabling attackers to spoof admin credentials, extract legitimate tokens, and modify any user's 'wp_capabilities' meta to grant themselves administrator privileges. CVSS 9.8 (Critical) with network vector, low complexity, and no authentication required. Vendor patch deployed in changeset 3506824.

Technical ContextAI

This vulnerability affects UKRSolution's Barcode Scanner WordPress plugin, a POS and inventory management system. The flaw stems from CWE-269 (Improper Privilege Management) where the plugin implements a custom token-based authentication mechanism that fatally trusts client-supplied user identification. The authentication flow accepts a Base64-encoded user ID in a token parameter without server-side validation of ownership, effectively allowing session hijacking through identifier spoofing. The plugin's 'barcodeScannerConfigs' AJAX action leaks valid authentication tokens to unauthenticated callers, while the 'setUserMeta' action permits arbitrary WordPress user metadata modification without meta-key restrictions. This combination creates a complete authentication bypass chain: an attacker can impersonate any user (including administrators) by Base64-encoding their user ID, retrieve that user's legitimate authentication token through the config leak, then use the token to directly manipulate WordPress core user capabilities stored in the wp_usermeta table.

RemediationAI

Immediately update to the patched version available via WordPress plugin repository changeset 3506824 or later (https://plugins.trac.wordpress.org/changeset/3506824/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders). WordPress administrators should navigate to Dashboard > Plugins > Updates and apply available updates for Barcode Scanner plugin. If immediate patching is not feasible, disable the plugin entirely until update can be applied-the authentication bypass allows complete site takeover, making compensating controls insufficient. After patching, conduct a security audit: review all WordPress user accounts for unexpected administrator-level users created during the vulnerability window, examine recent plugin-related activity in logs, check wp_usermeta table for suspicious 'wp_capabilities' modifications (SELECT * FROM wp_usermeta WHERE meta_key = 'wp_capabilities' ORDER BY umeta_id DESC LIMIT 50), and consider rotating authentication credentials for all administrative users. The patch restricts meta-key access in setUserMeta and implements proper token validation, but pre-existing compromised accounts will persist. For complete incident response guidance, consult Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/a213e844-a0d3-4123-9f72-caef7702804c?source=cve.