Barcode Scanner Mobile App Inventory Manager Order Fulfillment System Pos Point Of Sale CVE-2026-4880

No special conditions - remote unauthenticated exploitation against default configurations of Barcode Scanner (+Mobile App) plugin for WordPress. The vulnerability requires only that the plugin is installed and active; no specific feature enablement, non-default settings, or administrative actions are necessary. Attack succeeds against the WordPress admin-ajax.php endpoint accessible on all standard WordPress installations. Exploitation is limited only by network access to the WordPress site-no user interaction, valid credentials, or privileged access required. Attackers need knowledge of a valid WordPress user ID (typically discoverable through author enumeration, REST API user endpoints, or sequential guessing starting from ID 1), but this represents minimal reconnaissance rather than a meaningful barrier.

This represents a critical real-world risk requiring immediate action. CVSS 9.8 reflects maximum severity across all dimensions: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with complete impact to confidentiality, integrity, and availability. The attack is fully automatable-an unauthenticated attacker can programmatically enumerate user IDs (typically sequential integers starting at 1), spoof admin identity, extract tokens via HTTP request, and elevate privileges through another API call. The vulnerability chain requires no special deployment conditions beyond the plugin being active, making every installation immediately exploitable. While no CISA KEV listing or public exploit code is confirmed at time of analysis, the technical details disclosed in Wordfence threat intel and WordPress Trac provide a complete exploitation blueprint. The straightforward attack path (Base64 encoding, two HTTP requests) combined with the high-value target (WordPress admin access) makes weaponization highly probable. WordPress plugins with authentication bypasses historically see rapid exploitation once details are public. The vendor has released a patch (changeset 3506824), indicating the vulnerability is confirmed and reproducible.

An attacker identifies a WordPress site running the vulnerable Barcode Scanner plugin through banner grabbing or plugin enumeration. Without authentication, they send an HTTP POST request to /wp-admin/admin-ajax.php with action=barcodeScannerConfigs and a Base64-encoded user ID of '1' (typically the first administrator account). The plugin responds with the legitimate admin user's authentication token. The attacker then issues a second POST request to the same endpoint with action=setUserMeta, including the stolen admin token and parameters to modify their own user account's 'wp_capabilities' meta value to grant administrator role. Within seconds, the attacker escalates from no access to full WordPress administrative control, enabling site defacement, malware injection, customer data exfiltration from e-commerce systems, or pivot attacks against the hosting infrastructure.