Foosales Point Of Sale Pos For Woocommerce
Monthly
Authenticated privilege escalation in the FooSales - Point of Sale (POS) for WooCommerce plugin for WordPress (all versions up to and including 1.43.0) allows any account with FooSales Cashier-level access or above to overwrite arbitrary users' email addresses - including an administrator's - and then abuse WordPress's standard password-reset workflow to take over those accounts. The flaw is a missing identity/ownership check (CWE-269) in the plugin's user-details update path, rated CVSS 8.8 with PR:L (authenticated, low privilege) and no user interaction required; the only real barrier is obtaining a Cashier-or-higher role, after which full site compromise is achievable provided email-based password reset is enabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the available data, but the low prerequisite privilege and high confidentiality/integrity/availability impact make this a genuinely high-priority flaw for any site running the affected plugin. Patch status per available data: upstream fix available (changeset/commit); released patched version not independently confirmed.
Authenticated privilege escalation in the FooSales - Point of Sale (POS) for WooCommerce plugin for WordPress (all versions up to and including 1.43.0) allows any account with FooSales Cashier-level access or above to overwrite arbitrary users' email addresses - including an administrator's - and then abuse WordPress's standard password-reset workflow to take over those accounts. The flaw is a missing identity/ownership check (CWE-269) in the plugin's user-details update path, rated CVSS 8.8 with PR:L (authenticated, low privilege) and no user interaction required; the only real barrier is obtaining a Cashier-or-higher role, after which full site compromise is achievable provided email-based password reset is enabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the available data, but the low prerequisite privilege and high confidentiality/integrity/availability impact make this a genuinely high-priority flaw for any site running the affected plugin. Patch status per available data: upstream fix available (changeset/commit); released patched version not independently confirmed.