What is the CVSS score of CVE-2026-77183?

CVE-2026-77183 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-77183?

Within 24 hours, inventory all WordPress installations running FooSales - Point of Sale (POS) for WooCommerce at or below version 1.43.0, audit every account holding a Cashier role or above for legitimacy and recent activity, and immediately rotate credentials and enforce multi-factor authentication on all administrator accounts; where email-based password reset cannot be disabled site-wide, restrict it or require administrator approval for resets until further notice. Within 7 days, reduce the attack surface by removing or downgrading unnecessary Cashier-or-higher accounts, restrict plugin access to only staff who genuinely need POS functions, disable self-service email change capability for non-administrators if the plugin or a companion plugin permits it, and place the plugin behind enhanced monitoring for user-email and password-reset changes. Within 30 days, if no vendor patch is released, evaluate replacing the FooSales plugin with an alternative POS integration, or isolate it within a locked-down WordPress instance with least-privilege roles; continue to monitor the vendor's advisory channel and re-test as soon as a fixed version above 1.43.0 becomes available, then apply it under an emergency change window.

FooSales POS CVE-2026-77183

EUVD-2026-96102 HIGH

Improper Privilege Management (CWE-269)

2026-10-10 Wordfence

GHSA-mqr2-vf6c-h2jp

WordPress Privilege Escalation Wordpress Plugin Foosales Point Of Sale Pos For Woocommerce

8.8

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as FooSales Cashier-level user
Delivery

Call plugin user-update endpoint (REST/XML-RPC)
Exploit

Overwrite administrator email with attacker address
Execution

Trigger WordPress password reset
Persist

Capture reset link and set new password
Impact

Log in as administrator with full site control

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires an authenticated account with FooSales 'Cashier-level access and above' (PR:L) on a WordPress site running the FooSales POS for WooCommerce plugin version 1.43.0 or earlier. The specific weakness is the plugin's user-details update path (the REST API handler in class-foosales-rest-api.php and/or the XML-RPC functions in foosales-xmlrpc-functions.php per the patch) failing to validate that the requester owns the account being modified, allowing modification of an arbitrary user's email - including an administrator's. No special non-default configuration or user interaction is needed beyond possessing a Cashier-or-higher role; the main limiting factor is therefore obtaining that role, and successful admin takeover additionally relies on the standard WordPress email-based password-reset workflow being enabled.
Impact	This is a genuinely high-priority flaw for any site running the affected plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with full High impact to confidentiality, integrity, and availability (8.8). The low-privilege requirement maps directly to the description's 'FooSales Cashier-level access and above', which is a realistic and often widely-distributed role in a retail/POS deployment, so the PR:L bar is low in practice. The decisive escalation factor is that the flaw permits changing an administrator's email and then triggering a password reset to seize the admin account - effectively full site takeover from a minor role. No EPSS score, SSVC decision data, KEV listing, or public POC was supplied in the input, so exploitation-probability signals are absent rather than reassuring: the absence of a published exploit does not lower the structural severity, and the vulnerability class (broken identity validation on a profile-update endpoint) is historically easy to weaponize. A vendor/patch changeset is present (Wordfence + WordPress plugin trac), confirming the fix exists but also confirming the vulnerable code path is public, which typically shortens time-to-exploit. Net: treat as a real priority (patch urgently) rather than an inflated-CVSS low-risk item, with the caveat that real-world exploitation volume is unquantified because EPSS/KEV/POC data were not provided.
Exploit ScenarioDerived	An attacker who holds (or phishes/registers into) a FooSales Cashier-level account on a WooCommerce store sends a crafted request to the plugin's REST API or XML-RPC user-update handler, changing the administrator's email address to one they control. They then invoke the standard WordPress password-reset flow, receive the reset link at the attacker-controlled address, and log in as administrator with full control of the site. No public exploit code was identified at time of analysis, but the vulnerable endpoints are visible in the referenced patch changeset.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 10, 2026

Authenticated privilege escalation in the FooSales - Point of Sale (POS) for WooCommerce plugin for WordPress (all versions up to and including 1.43.0) allows any account with FooSales Cashier-level access or above to overwrite arbitrary users' email addresses - including an administrator's - and then abuse WordPress's standard password-reset workflow to take over those accounts. The flaw is a missing identity/ownership check (CWE-269) in the plugin's user-details update path, rated CVSS 8.8 with PR:L (authenticated, low privilege) and no user interaction required; the only real barrier is obtaining a Cashier-or-higher role, after which full site compromise is achievable provided email-based password reset is enabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the available data, but the low prerequisite privilege and high confidentiality/integrity/availability impact make this a genuinely high-priority flaw for any site running the affected plugin. Patch status per available data: upstream fix available (changeset/commit); released patched version not independently confirmed.

RemediationAI

Apply the upstream fix as soon as possible: update the plugin to the first released version containing Trac changeset 3719657 (the changeset patches both admin/class-foosales-rest-api.php and admin/foosales-xmlrpc-functions.php), since the supplied data confirms an upstream fix but does not independently confirm a tagged patched release version - verify the installed plugin version against the vendor changelog before assuming you are covered, and re-check the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/97097d41-1d78-4db0-8ee2-70a776bd99f2?source=cve for the fixed version as it is published. If you cannot patch immediately, the most effective compensating control is to reduce the attack surface by auditing and removing all unnecessary FooSales Cashier-and-above accounts and temporarily revoking POS roles from anyone who does not strictly need them (trade-off: it breaks POS workflows for those staff while in place). Where the POS integration does not require XML-RPC, disable XML-RPC entirely (e.g. via an xmlrpc_enabled filter or a security plugin), which closes one of the two patched code paths but may break other integrations that rely on it. Because the exploit abuses the standard WordPress lost-password email flow, you can partially blunt it by reviewing and enforcing strict control over administrator email addresses, enabling email-change confirmation for administrator accounts, and monitoring for unexpected wp_update_user/email-change events and password-reset notifications; note this is a detection/hardening measure, not a fix, and it does not prevent the initial unauthorized email change. Finally, audit all existing user accounts for email addresses that were modified without authorization and force password resets for any administrator whose email may have been altered, since takeover may already have occurred; uninstalling the plugin removes the vulnerable code but also disables all FooSales POS functionality.

Affected VersionsENISA

FooSales – Point of Sale (POS) for WooCommerce 0 ≤1.43.0

Affected Packages

euvd foosales_point_of_sale_pos_for_woocommerce no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is a WordPress plugin that exposes point-of-sale functionality for WooCommerce and registers its own REST API endpoints and XML-RPC handlers, specifically admin/class-foosales-rest-api.php and admin/foosales-xmlrpc-functions.php. The root cause maps to CWE-269 (Improper Privilege Management): the handler that updates stored user details (notably the account email address) does not verify that the caller is the owner of the account being modified, effectively a broken-access-control / object-ownership failure in which authorization is based on the caller simply having a FooSales role rather than on any relationship between caller and target record. WordPress treats an account's email address as the password-recovery address, so any component able to write an arbitrary user's email can redirect that user's password-reset token to an attacker-controlled mailbox via the standard lost-password flow - converting a seemingly minor data-integrity bug into full account takeover. The CPE cpe:2.3:a:foosales:foosales_-_point_of_sale_(pos)_for_woocommerce:*:*:*:*:*:*:*:* is version-agnostic in the supplied feed, and the description bounds the exposure to versions up to and including 1.43.0; the fix touches both the REST and XML-RPC code paths, indicating the same missing check existed in more than one entry point into the user-update logic.

Know when Wordpress Plugin gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Network-reachable endpoint, low complexity, no user interaction; PR:L reflects the required Cashier-level account, and admin account takeover yields full C/I/A impact on the same authorization scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

The FooSales - Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with FooSales Cashier-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

Executive ViewAI

Why It Matters

A privilege-escalation flaw in the FooSales - Point of Sale (POS) for WooCommerce plugin, affecting all versions up to and including 1.43.0, allows a low-privileged staff account (Cashier or higher) to seize control of administrator accounts and, by extension, the entire WordPress site. Because Cashier accounts are routinely issued to store staff, contractors, and seasonal employees, the pool of potential abusers is far wider than a typical admin-only flaw, exposing customer records, order and payment data, and the integrity of the storefront itself to insider misuse, compromised credentials, or any account that leaks through phishing. With no vendor patch available, leadership should treat this as an accepted-risk decision requiring compensating controls until remediation is released.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: enforce multi-factor authentication and mandatory credential rotation for all administrator and Cashier-or-higher accounts; eliminate or downgrade unnecessary elevated POS roles; disable or tightly control WordPress email-based password reset for privileged accounts; monitor and alert on changes to user email addresses and password-reset activity in the plugin's user-details update path; restrict plugin access to trusted staff only; consider network or hosting-level controls limiting who can reach the plugin's administrative endpoints.

Threat Intelligence Overview

EPSS Score

0.3%

Top 80% exploitable

Prevalence

Low

niche WooCommerce POS plugin, limited WordPress install base

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.