Vitepos POS CVE-2026-92766

The Vitepos (vitepos-lite) plugin must be installed and active at version ≤3.5.1 on a WooCommerce/WordPress site, and the /vitepos/v1/vendor/list REST route must be reachable. Per the advisory the route's permission callback requires only a POS role assignment (e.g., vtpos-cashier) rather than an elevated WordPress capability, though the same description also claims fully unauthenticated exploitation - this access prerequisite is the key limiting factor and should be verified. The injectable input is the 'src_by' parameter, which is insufficiently escaped and passed into a non-prepared SQL query. No user interaction or non-default configuration beyond having the plugin active is required; impact is limited to database read/disclosure, not modification.

This is a credible, actionable priority but not a top-tier emergency. The CVSS 3.1 base score of 7.5 reflects network attack vector (AV:N), low complexity (AC:L), no privileges claimed (PR:N), no user interaction (UI:N), and high confidentiality impact with no integrity or availability impact (C:H/I:N/A:N) - consistent with an unauthenticated read-oriented SQL injection (CWE-89). However, the description contains an internal conflict: it opens by claiming 'unauthenticated attackers' can exploit it, then states the /vitepos/v1/vendor/list REST route's permission callback 'requires only a POS role assignment' such as vtpos-cashier. A permission callback that requires any role is, strictly, an authentication gate, which contradicts the PR:N rating - verify with Wordfence/vendor whether the route is truly reachable with no session or only with a low-privilege POS role. No EPSS score, KEV listing, or public POC was provided; exploitation status is therefore 'no public exploit identified at time of analysis.' Absence of KEV/EPSS data means real-world exploitation likelihood cannot be quantified from the inputs. SSVC framing: technical impact is partial (confidentiality-only data disclosure, not full system takeover), and automatability is plausible for a parameter-based SQLi but unconfirmed. Net: treat as a prompt-patch item for any site running Vitepos ≤3.5.1, weighted by the fact that POS/cashier credentials are routinely and broadly issued in retail environments, lowering the practical barrier even under the authenticated reading.

An attacker (either unauthenticated, or holding a low-privilege POS role such as vtpos-cashier, per the conflicting access description) sends a crafted request to the /vitepos/v1/vendor/list REST endpoint with a malicious 'src_by' parameter. Because the value is insufficiently escaped and the SQL query is not properly prepared, the attacker appends additional SQL to extract sensitive data (e.g., user records, order/customer data) from the WordPress/WooCommerce database. No public exploit code was identified at the time of analysis, but the vulnerability class and low attack complexity make reliable exploitation straightforward to develop.