EUVD-2026-38215
GHSA-hq2m-9p82-5366
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with Vitepos custom role
-
DeliveryCall user-creation REST API endpoint
-
ExploitAssign administrator role to new account
-
ExecutionLog in as new admin
-
ImpactFull WordPress site takeover
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session as a user holding a custom Vitepos role (PR:L) and the ability to reach the plugin's user-creation REST API endpoint over the network - the specific prerequisite is possession of a non-administrator Vitepos-assigned role that can invoke that endpoint. What limits exploitation: the attacker cannot be fully anonymous (valid credentials for a Vitepos custom role are needed), the Vitepos plugin must be installed and below version 3.4.2, and the site must actually provision such delegated POS roles; no user interaction, no special client, and no non-default plugin configuration beyond having Vitepos active are required. There is no cross-system scope change (S:U), so impact is confined to the WordPress site itself. |
| Impact | The signals are consistent and point to a genuine but access-gated risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) indicates network-reachable, low-complexity exploitation requiring some authentication, with total confidentiality/integrity/availability impact - matching the SSVC 'Technical Impact: total' rating. Counterbalancing this, EPSS is low at 0.24% (14th percentile), SSVC Exploitation is 'none' and Automatable is 'no', and the vulnerability is absent from CISA KEV, so there is no evidence of widespread or automated exploitation despite public POC availability. The key limiting factor is PR:L: an attacker must already possess a valid Vitepos custom role, which narrows the realistic threat to insiders, compromised staff accounts, or sites that provision such roles broadly. This is a real 'patch promptly' issue for sites running Vitepos with delegated POS roles, but not an unauthenticated internet-wide emergency. |
| Exploit ScenarioDerived | A retail employee with a Vitepos cashier/POS-operator account (or an attacker who has phished such credentials) sends a crafted authenticated request to the plugin's user-creation REST endpoint, specifying the 'administrator' role for the new account. The server creates the admin user without rejecting the role, and the attacker logs in with full control of the WordPress site to install backdoors, exfiltrate customer/order data, or deface the store. Publicly available exploit code from WPScan lowers the skill required to reproduce this. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Privilege escalation in the Vitepos WordPress point-of-sale plugin before 3.4.2 lets an authenticated user holding a custom Vitepos role assign themselves the administrator role through an insufficiently restricted user-creation REST API endpoint, resulting in full site takeover. WPScan reports publicly available exploit code exists, though the flaw is not listed in CISA KEV and SSVC records no observed exploitation. With a modest EPSS of 0.24% (14th percentile) but a 'total' technical impact, this is a credentialed-but-realistic escalation path rather than a mass-exploited internet threat.
RemediationAI
Vendor-released patch: upgrade the Vitepos plugin to version 3.4.2 or later, which restricts the roles assignable through the user-creation REST endpoint. Until the update is applied, reduce exposure by minimizing the number of accounts holding custom Vitepos roles and auditing existing users for any unexpected administrator accounts created recently (a sign of prior exploitation); revoke or downgrade untrusted POS-operator accounts. As a compensating control you can restrict access to the plugin's REST API routes at the web-server or WAF layer to trusted staff IP ranges, accepting that this may break remote or mobile POS terminals that rely on those endpoints. Review the WPScan advisory (https://wpscan.com/vulnerability/6680cc6a-9758-4040-bb39-7b9545041dc3/) for detection guidance and confirm the fixed version before deploying.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vitepos is a WooCommerce/WordPress point-of-sale plugin that exposes REST API endpoints for staff and user management as part of its POS operator model. The root cause is CWE-269 (Improper Privilege Management): the user-creation endpoint fails to validate or allowlist which WordPress roles a caller may assign, so a lower-privileged Vitepos custom role (e.g. cashier/POS operator) can specify 'administrator' when creating a new account. Because WordPress roles map directly to capability sets, granting the administrator role confers unrestricted control over the entire site. The affected component is the plugin's own REST route rather than WordPress core, and the CPE (cpe:2.3:a:unknown:vitepos:*) covers all Vitepos versions prior to the fixed 3.4.2.
Know when Vitepos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network REST endpoint with low complexity but requires an authenticated Vitepos custom role (PR:L); role escalation to admin yields total C/I/A impact within the unchanged WordPress scope.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.
Articles & Coverage 2
Executive ViewAI
The Vitepos WordPress point-of-sale plugin (versions before 3.4.2) enables authenticated staff with plugin roles to escalate to administrator access, creating risk of payment tampering, customer data exposure, and site compromise. Organizations running Vitepos for e-commerce or payment processing face operational disruption and financial fraud if internal staff accounts exploit this privilege escalation path.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager rol
Blind SQL injection in the appsbd Vitepos (vitepos-lite) WordPress point-of-sale plugin affects all versions up to and i
SQL injection in the vitepos WordPress plugin before version 3.6.0 enables authenticated administrators to exfiltrate da
Blind SQL injection in the Appsbd Vitepos / vitepos-lite WordPress plugin, affecting versions through 3.6.1, allows an a
Unauthenticated sensitive data exposure in the Vitepos WordPress plugin (versions 3.4.2 and earlier) lets remote attacke
Privilege escalation in the Vitepos WordPress point-of-sale plugin through version 3.5.0 lets an authenticated account t
Exploit-DB