Barcode Scanner plugin CVE-2026-62118

Exploitable only against WordPress sites with the Barcode Scanner with Inventory & Order Manager plugin installed and active at version 1.13.1 or earlier; the vulnerable code path is a plugin endpoint (AJAX/REST action) that omits a capability/authorization check. No authentication, user interaction, non-default configuration, or specific timing is required per the CVSS vector (PR:N/UI:N/AC:L) - the primary limiting factor is simply the presence of this specific plugin at a vulnerable version, which bounds the realistic attack surface to that plugin's user base, and the per-action impact is constrained to the Low confidentiality/integrity/availability effects of the affected functions.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, which on its face is attractive to attackers; however, the impact metrics are uniformly Low (C:L/I:L/A:L) and scope is Unchanged, yielding a 7.3 (High) score that reflects broad reachability rather than severe consequence. This is CWE-862 (Missing Authorization) - an unauthenticated actor can invoke plugin functions that should be access-controlled, consistent with the 'Broken Access Control' classification from Patchstack. No EPSS probability, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active or imminent widespread exploitation. Net assessment: a genuine but moderate-priority issue - easy to trigger but limited per-request impact - that matters most to the specific population running this niche WordPress plugin. EPSS, KEV, and POC signals are all absent (not confirmed negative), so exploitation likelihood cannot be quantified from the input and should be treated as unknown rather than low.

An unauthenticated attacker sends crafted HTTP requests directly to the plugin's AJAX or REST endpoints on a WordPress site running Barcode Scanner with Inventory & Order Manager <= 1.13.1, invoking actions that lack a capability/authorization check. Because no authentication, user interaction, or special timing is required (AV:N/AC:L/PR:N/UI:N), the attacker can read or modify inventory/order data within the Low-impact bounds of the flaw. No public exploit code was identified at the time of analysis.