EUVD-2026-38215
GHSA-hq2m-9p82-5366
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network REST endpoint with low complexity but requires an authenticated Vitepos custom role (PR:L); role escalation to admin yields total C/I/A impact within the unchanged WordPress scope.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.
Articles & Coverage 2
AnalysisAI
Privilege escalation in the Vitepos WordPress point-of-sale plugin before 3.4.2 lets an authenticated user holding a custom Vitepos role assign themselves the administrator role through an insufficiently restricted user-creation REST API endpoint, resulting in full site takeover. WPScan reports publicly available exploit code exists, though the flaw is not listed in CISA KEV and SSVC records no observed exploitation. With a modest EPSS of 0.24% (14th percentile) but a 'total' technical impact, this is a credentialed-but-realistic escalation path rather than a mass-exploited internet threat.
Technical ContextAI
Vitepos is a WooCommerce/WordPress point-of-sale plugin that exposes REST API endpoints for staff and user management as part of its POS operator model. The root cause is CWE-269 (Improper Privilege Management): the user-creation endpoint fails to validate or allowlist which WordPress roles a caller may assign, so a lower-privileged Vitepos custom role (e.g. cashier/POS operator) can specify 'administrator' when creating a new account. Because WordPress roles map directly to capability sets, granting the administrator role confers unrestricted control over the entire site. The affected component is the plugin's own REST route rather than WordPress core, and the CPE (cpe:2.3:a:unknown:vitepos:*) covers all Vitepos versions prior to the fixed 3.4.2.
RemediationAI
Vendor-released patch: upgrade the Vitepos plugin to version 3.4.2 or later, which restricts the roles assignable through the user-creation REST endpoint. Until the update is applied, reduce exposure by minimizing the number of accounts holding custom Vitepos roles and auditing existing users for any unexpected administrator accounts created recently (a sign of prior exploitation); revoke or downgrade untrusted POS-operator accounts. As a compensating control you can restrict access to the plugin's REST API routes at the web-server or WAF layer to trusted staff IP ranges, accepting that this may break remote or mobile POS terminals that rely on those endpoints. Review the WPScan advisory (https://wpscan.com/vulnerability/6680cc6a-9758-4040-bb39-7b9545041dc3/) for detection guidance and confirm the fixed version before deploying.
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager rol
Blind SQL injection in the appsbd Vitepos (vitepos-lite) WordPress point-of-sale plugin affects all versions up to and i
SQL injection in the vitepos WordPress plugin before version 3.6.0 enables authenticated administrators to exfiltrate da
Unauthenticated sensitive data exposure in the Vitepos WordPress plugin (versions 3.4.2 and earlier) lets remote attacke
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today