What is the CVSS score of CVE-2026-57385?

CVE-2026-57385 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of Vitepos are affected by CVE-2026-57385?

Vitepos-lite WordPress POS plugin (versions through 3.4.2) contains a SQL injection vulnerability allowing any staff member or low-privilege user to extract customer data, transaction records, and…

How to fix or mitigate CVE-2026-57385?

Within 24 hours: inventory all WordPress installations running Vitepos-lite versions 3.4.2 and earlier; audit and restrict database user privileges assigned to the plugin to only necessary tables and operations. Within 7 days: implement database activity monitoring to detect SQL injection attempts; deploy Web Application Firewall rules to block SQL injection patterns; enforce multi-factor authentication for all POS staff accounts. Within 30 days: monitor vendor communications for Vitepos-lite patch availability; if a patch is released, prepare upgrade testing and deploy immediately; otherwise, evaluate alternative POS solutions and implement additional security controls.

Vitepos CVE-2026-57385

EUVD-2026-43459 HIGH

SQL Injection (CWE-89)

2026-07-13 Patchstack

WordPress SQLi Wordpress Plugin Vitepos Appsbd

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-reachable low-complexity SQLi requiring a low-privilege authenticated account (PR:L); blind injection reaches data beyond the plugin boundary (S:C, C:H) with no direct integrity impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:03 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through <= 3.4.2.

AnalysisAI

Blind SQL injection in the appsbd Vitepos (vitepos-lite) WordPress point-of-sale plugin affects all versions up to and including 3.4.2, allowing an authenticated attacker with low privileges to inject crafted SQL into backend database queries and infer data via boolean/time-based responses. The CVSS 3.1 base score of 8.5 reflects a scope change (S:C) with high confidentiality impact, meaning the plugin's SQL context can reach database contents beyond its own security boundary. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

Vitepos is a WordPress plugin (CPE cpe:2.3:a:appsbd:vitepos) that adds point-of-sale functionality to WooCommerce/WordPress stores, sharing the site's underlying MySQL/MariaDB database. The root cause is CWE-89, Improper Neutralization of Special Elements used in an SQL Command: user-controllable input is concatenated into a SQL statement without parameterization or proper escaping (WordPress plugins typically should use $wpdb->prepare()). Because the injection is 'blind,' the query does not return data directly in the response; instead an attacker infers results through boolean-differential or time-delay behavior, which is slower but still fully effective for extracting arbitrary database rows.

RemediationAI

Upgrade the Vitepos / vitepos-lite plugin to a release later than 3.4.2 once appsbd publishes a fixed version; consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/vitepos-lite/vulnerability/wordpress-vitepos-plugin-3-4-2-sql-injection-vulnerability) for the exact patched version, which was not enumerated in the available data - no vendor-released fixed version is independently confirmed here, so do not assume a version number. Until a patch is applied, restrict access to the plugin's POS endpoints by limiting which authenticated roles can reach them, deploy a WordPress/WooCommerce-aware WAF or virtual patch (Patchstack offers one) to filter SQL metacharacters on the affected parameters, and tighten database user privileges so the WordPress DB account cannot read tables beyond what the store needs - the trade-off being possible disruption to legitimate POS staff workflows and the need to test WAF rules against false positives. Disabling the plugin entirely is the strongest control if the POS feature is non-essential.