What is the CVSS score of CVE-2026-54841?

CVE-2026-54841 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Vitepos are affected by CVE-2026-54841?

The Vitepos WordPress plugin (versions 3.4.2 and earlier) contains an unauthenticated vulnerability allowing remote attackers to access sensitive information without login credentials.

How to fix or mitigate CVE-2026-54841?

Within 24 hours: Inventory all WordPress installations; identify instances running Vitepos plugin versions 3.4.2 and earlier; assess data sensitivity on affected systems. Within 7 days: Disable or uninstall the Vitepos plugin from all affected WordPress installations; implement Web Application Firewall rules to block access to sensitive endpoints. Within 30 days: Monitor Vitepos vendor advisories for patch release; establish database access restrictions and IP whitelisting as permanent compensating controls; conduct data access audit to identify what was exposed during vulnerability window.

Vitepos CVE-2026-54841

EUVD-2026-39369 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-25 Patchstack

GHSA-wv7v-x5c8-prv7

WordPress Information Disclosure Wordpress Plugin Vitepos Appsbd

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network endpoint leaks sensitive data with no interaction (AV:N/AC:L/PR:N/UI:N); impact is confidentiality-only (C:H, I:N, A:N), matching CWE-201 disclosure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:19 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the Vitepos WordPress plugin (versions 3.4.2 and earlier) lets remote attackers read sensitive information without any authentication. The flaw is reported by Patchstack and classified as CWE-201 (information exposure through sent data), with a CVSS 3.1 base score of 7.5 driven entirely by a high confidentiality impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

Vitepos (distributed as 'vitepos-lite', CPE cpe:2.3:a:appsbd:vitepos) is a point-of-sale plugin for WordPress/WooCommerce sites developed by appsbd. The root cause is classified as CWE-201, Insertion of Sensitive Information Into Sent Data, meaning the application returns sensitive data in a response that should not contain it - typically an API/AJAX endpoint that fails to enforce authorization and leaks records (such as customer, order, or configuration data) to any caller. Because this is a WordPress plugin endpoint exposed over HTTP, the data is reachable network-side without a session, consistent with the AV:N/PR:N CVSS metrics.

RemediationAI

Upgrade Vitepos to a release later than 3.4.2 once the vendor (appsbd) publishes a fixed version; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/vitepos-lite/vulnerability/wordpress-vitepos-plugin-3-4-2-sensitive-data-exposure-vulnerability for the exact fixed build, as no patched version number is confirmed in the available data. If an updated version is not yet available, compensating controls include restricting access to the vulnerable Vitepos AJAX/REST endpoints at the web server or WAF layer (block or authenticate the plugin's admin-ajax actions and REST routes), or deactivating the Vitepos plugin until a fix ships - noting this disables POS functionality for the store. Patchstack virtual-patching can also block the request pattern without code changes. Verify any endpoint blocking does not break legitimate front-end POS workflows before enforcing it in production.