What is the CVSS score of CVE-2026-6072?

CVE-2026-6072 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Oliver POS CVE-2026-6072

EUVD-2026-31036 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-20 Wordfence

GHSA-mqwc-jxpp-f3rj

WordPress PHP Authentication Bypass

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:33 vuln.today

DescriptionCVE.org

The Oliver POS - A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.4.2.6. The plugin protects its entire /wp-json/pos-bridge/* REST API namespace through the oliver_pos_rest_authentication() permission callback, which uses a loose PHP comparison () to compare the attacker-supplied 'OliverAuth' header value against the 'oliver_pos_authorization_token' option. On fresh installations where the admin has not yet completed the connection flow, this option is unset (get_option returns false). Due to PHP's type juggling, the loose comparison '0' false evaluates to true, allowing an unauthenticated attacker to bypass authentication by sending 'OliverAuth: 0'. This grants full access to all POS API endpoints, enabling attackers to read user data (including administrator details), update user profiles (including email addresses), and delete non-admin users. An admin account email reset can lead to site takeover.

AnalysisAI

Authentication bypass in the Oliver POS WooCommerce Point of Sale WordPress plugin (all versions through 2.4.2.6) allows unauthenticated remote attackers to gain full access to the plugin's REST API namespace by exploiting PHP type juggling in the permission callback. On fresh installations where the admin has not yet completed the connection wizard, the stored authorization token is unset (PHP false), and sending the header 'OliverAuth: 0' satisfies the loose comparison '0' == false, returning true and granting unrestricted access to all /wp-json/pos-bridge/* endpoints. Successful exploitation enables reading administrator account details, updating user profiles including email addresses, deleting non-admin users, and ultimately resetting the admin email to achieve full WordPress site takeover. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

The vulnerability resides in the oliver_pos_rest_authentication() permission callback (class-pos-bridge.php, line 1679) which guards the entire /wp-json/pos-bridge/* REST API namespace registered by the Oliver POS WooCommerce plugin (CPE: cpe:2.3:a:oliverpos:oliver_pos_-_a_woocommerce_point_of_sale_(pos):*:*:*:*:*:*:*:*). The root cause is CWE-639: Authorization Bypass Through User-Controlled Key - the function retrieves the stored token via get_option('oliver_pos_authorization_token') and compares it against the attacker-controlled HTTP header value 'OliverAuth' using PHP's loose equality operator () rather than strict equality (=). PHP's type juggling rules mean that when get_option returns false (the value for an unset option on a fresh install), the expression '0' == false evaluates to true because the string '0' is cast to a boolean false before comparison. User-affecting endpoints in class-pos-bridge-user.php (lines 170, 195, 231) expose profile read, update, and delete operations that become fully accessible once the callback is bypassed. The condition is specific to the window between plugin installation and completion of the OliverPOS cloud connection wizard, which is the step that writes the authorization token into WordPress options.

RemediationAI

No vendor-released patch has been identified at time of analysis - the latest tagged release in the WordPress Plugin Repository (2.4.2.6) still contains the vulnerable code at class-pos-bridge.php line 1677/1679. Site operators should immediately complete the OliverPOS cloud connection wizard if not already done, as this writes a real token to oliver_pos_authorization_token and eliminates the false-value bypass condition; note this does not fix the underlying loose comparison and a future token reset or reinstall could reintroduce exposure. As a compensating control, restrict external access to the /wp-json/pos-bridge/* URL path at the web server or WAF layer (e.g., nginx location block, Apache mod_rewrite, or a WAF rule blocking that path prefix for non-internal IPs) - this prevents remote unauthenticated access but may break legitimate POS terminal connectivity if terminals are external. Monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/ca6aa922-9c58-445c-b88a-3d1d1c95102c) and the WordPress Plugin Repository (https://plugins.trac.wordpress.org/browser/oliver-pos/) for an updated release that replaces with = in the permission callback.