EUVD-2026-89868
GHSA-x5hj-x887-f2r7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with existing custom/elevated role
-
DeliveryInvoke vulnerable Vitepos privilege-management function
-
ExploitAssign elevated capabilities to own account
-
ExecutionGain administrator-level control
-
ImpactCompromise site data and integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Requires an authenticated WordPress account already holding a custom or elevated Vitepos role (PR:H) on a site running Vitepos <= 3.5.0; exploitation is remote and low-complexity with no user interaction once that account exists. The principal limiting factor is the high-privilege prerequisite - the attacker must possess a valid non-trivial account (such as POS staff/manager) before escalation is possible, so this cannot be triggered by anonymous or subscriber-level visitors. Deployment is limited to WordPress installations that have the Vitepos POS plugin installed and active. |
| Impact | This is a CVSS 7.2 (High) privilege escalation flaw (CWE-266, improper privilege assignment) in the Vitepos WordPress POS plugin, reported by Patchstack. The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity attack requiring high privileges (PR:H) and no user interaction, yielding full confidentiality, integrity, and availability impact on the same scope. The PR:H requirement is the dominant risk-limiting factor: the attacker must already hold an elevated/custom-role account within the site, so this is a vertical escalation from an already-privileged foothold rather than a pre-auth takeover, which materially narrows the realistic attacker population. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the supplied data - exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. On balance this is a genuine but moderate-priority issue: the triple-High impact and full account/site compromise potential are serious, but the PR:H gate plus the plugin's niche point-of-sale footprint keep real-world mass-exploitation risk lower than the raw 7.2 might suggest. The C:H/I:H/A:H impact should be read against the S:U scope - the effect is on the WordPress site itself, not a separate system. |
| Exploit ScenarioDerived | An attacker who already possesses a custom or elevated Vitepos/WordPress role (e.g. a POS staff or manager account) abuses improper privilege management in Vitepos <= 3.5.0 to grant themselves capabilities beyond their assigned role, escalating toward administrator-level control of the WordPress site. From there they can read sensitive data, alter content, or take over the site fully. No public exploit code is currently identified, and no user interaction is required once the privileged account is held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Privilege escalation in the Vitepos WordPress point-of-sale plugin through version 3.5.0 lets an authenticated account that already holds a custom or elevated Vitepos role - such as POS staff or manager - raise its own privileges to a higher level on the affected site, rated CVSS 7.2 (High). Exploitation is remote and low-complexity with no user interaction required once such an account exists, but the high-privilege prerequisite (PR:H) means anonymous visitors and ordinary subscriber-level users cannot trigger it, and only WordPress sites with the Vitepos plugin installed and active are exposed. No public exploit code has been identified at time of analysis, and the issue is reported by Patchstack as an improper privilege assignment (CWE-266) defect in the plugin's custom role handling.
RemediationAI
No vendor-released patch version is identified in the available data for CVE-2026-96815; the advisory documents the flaw as affecting Vitepos <= 3.5.0, so administrators should check the vendor/Patchstack advisory page (https://patchstack.com/database/wordpress/plugin/vitepos-lite/vulnerability/wordpress-vitepos-plugin-3-5-0-privilege-escalation-vulnerability?_s_id=cve) and the plugin's WordPress.org changelog for a fixed release, and upgrade as soon as one is published. Until a fix can be applied, the most effective compensating control is to deactivate and, if the store does not depend on it, remove the Vitepos plugin entirely - the trade-off being loss of POS functionality while it is disabled. If the plugin must stay live, audit every account holding a custom Vitepos role (POS staff, manager, etc.), revoke those custom roles from users who do not strictly need them, restrict role/capability changes to site administrators only, and enforce least privilege so that no non-administrative account retains an elevated Vitepos role; the trade-off is reduced operational flexibility for store staff. In addition, apply strong authentication (unique accounts, MFA where available) to the remaining privileged users, since the flaw requires an existing high-privilege account, and monitor user-role and capability changes for unexpected escalations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vitepos is a WordPress-based POS (point-of-sale) plugin published by Appsbd (CPE cpe:2.3:a:appsbd:vitepos:*:*:*:*:*:*:*:*) that introduces its own role and capability model on top of WordPress's native roles system, creating custom roles such as POS staff and manager to govern access to sales, inventory and settings screens. The weakness is classified as CWE-266 (Incorrect Privilege Assignment): the plugin fails to properly constrain which capabilities a holder of a custom Vitepos role may assign to itself or to other accounts, so a privileged-but-not-administrative user can escalate to a higher role. Because the vulnerable functionality is reachable through the plugin's remote request handling, the vector is scored AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - remote, low complexity, but gated behind an existing high-privilege account, with full compromise of confidentiality, integrity and availability for the affected site rather than across a scope boundary.
Know when Vitepos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Remote, low-complexity escalation requires an existing elevated/custom-role account (PR:H) with no interaction, yielding full site compromise (C/I/A:H) within the same scope.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.
Executive ViewAI
A high-severity privilege escalation flaw in the Vitepos WordPress point-of-sale plugin (through version 3.5.0) allows an existing POS staff or manager account to elevate its own permissions to a higher level on any site where the plugin is active. Because Vitepos is typically deployed on e-commerce and retail sites handling payment and customer data, a single compromised or malicious staff account could lead to broader site takeover. No vendor patch is currently available, so affected organizations must rely on access controls and monitoring until remediation is released.
No vendor-released patch identified at time of analysis. Interim mitigations: audit and remove unnecessary Vitepos custom/elevated roles, restrict and monitor POS staff and manager accounts, enforce least privilege and multi-factor authentication, rotate credentials for privileged POS users, alert on any WordPress role or capability changes, and apply WAF or virtual patching rules blocking unauthorized role-escalation requests; deactivate the plugin on sites where POS functionality is not business-critical.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Privilege escalation in the Vitepos WordPress point-of-sale plugin before 3.4.2 lets an authenticated user holding a cus
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager rol
Blind SQL injection in the appsbd Vitepos (vitepos-lite) WordPress point-of-sale plugin affects all versions up to and i
SQL injection in the vitepos WordPress plugin before version 3.6.0 enables authenticated administrators to exfiltrate da
Blind SQL injection in the Appsbd Vitepos / vitepos-lite WordPress plugin, affecting versions through 3.6.1, allows an a
Unauthenticated sensitive data exposure in the Vitepos WordPress plugin (versions 3.4.2 and earlier) lets remote attacke
Exploit-DB