Vitepos EUVD-2026-54992

Exploitation requires possession of a valid WordPress account assigned the Outlet Manager role - a custom role introduced by the Vitepos plugin. This role must exist in the target WordPress installation, meaning the site must have the Vitepos plugin installed and at least one Outlet Manager account provisioned. The attack is then network-accessible with no further interaction required (AV:N/AC:L/UI:N). What limits exploitation: the attacker must either legitimately hold or have previously compromised an Outlet Manager credential; sites without the Vitepos plugin or without any Outlet Manager accounts are not affected; S:U means impact is contained to the WordPress installation itself rather than the broader server or network. Authentication as an Outlet Manager is confirmed as a prerequisite by the CVSS PR:H vector.

The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately captures that network-accessible exploitation is possible but requires the Outlet Manager role - a non-trivial prerequisite. Real-world risk depends heavily on how broadly the Outlet Manager role is distributed within a given deployment; in a retail environment, multiple staff members may hold this role, significantly expanding the attack surface beyond what PR:H alone implies. EPSS at 0.13% (3rd percentile) indicates no current widespread automated exploitation. A publicly available exploit code exists per WPScan, which elevates urgency above a typical low-EPSS finding. No CISA KEV listing is present. Overall, risk is elevated for any WordPress-based POS deployment where Outlet Manager accounts exist and are potentially reachable by untrusted users - the combination of a public PoC and trivial post-authentication exploit execution makes this a meaningful priority for affected sites.

An attacker who holds or has compromised an Outlet Manager account on a Vitepos-enabled WordPress site calls the plugin's password-reset API endpoint, specifying an administrator user as the target. Because no per-target authorization check is performed, the API resets the administrator's password without restriction. The attacker then logs in as the administrator, achieving full site takeover. A public proof-of-concept is available from WPScan, making this straightforward to reproduce.