Vitepos
Monthly
SQL injection in the vitepos WordPress plugin before version 3.6.0 enables authenticated administrators to exfiltrate database contents via a crafted REST API report request. The vulnerability stems from an unsanitized identifier taken directly from the request body and concatenated into a SQL query, a textbook CWE-89 flaw. A publicly available exploit proof-of-concept exists per WPScan, though no active exploitation is confirmed in CISA KEV and the EPSS score of 0.16% reflects the high authentication bar.
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager role to reset the password of any WordPress account - including site administrators - and achieve full account takeover. The flaw stems from a missing per-target authorization check in the password-reset API endpoint, combined with the plugin granting the Outlet Manager role overly broad reset capabilities by default. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.13%, 3rd percentile), suggesting exploitation has not yet been observed at scale.
Blind SQL injection in the appsbd Vitepos (vitepos-lite) WordPress point-of-sale plugin affects all versions up to and including 3.4.2, allowing an authenticated attacker with low privileges to inject crafted SQL into backend database queries and infer data via boolean/time-based responses. The CVSS 3.1 base score of 8.5 reflects a scope change (S:C) with high confidentiality impact, meaning the plugin's SQL context can reach database contents beyond its own security boundary. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthenticated sensitive data exposure in the Vitepos WordPress plugin (versions 3.4.2 and earlier) lets remote attackers read sensitive information without any authentication. The flaw is reported by Patchstack and classified as CWE-201 (information exposure through sent data), with a CVSS 3.1 base score of 7.5 driven entirely by a high confidentiality impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege escalation in the Vitepos WordPress point-of-sale plugin before 3.4.2 lets an authenticated user holding a custom Vitepos role assign themselves the administrator role through an insufficiently restricted user-creation REST API endpoint, resulting in full site takeover. WPScan reports publicly available exploit code exists, though the flaw is not listed in CISA KEV and SSVC records no observed exploitation. With a modest EPSS of 0.24% (14th percentile) but a 'total' technical impact, this is a credentialed-but-realistic escalation path rather than a mass-exploited internet threat.
SQL injection in the vitepos WordPress plugin before version 3.6.0 enables authenticated administrators to exfiltrate database contents via a crafted REST API report request. The vulnerability stems from an unsanitized identifier taken directly from the request body and concatenated into a SQL query, a textbook CWE-89 flaw. A publicly available exploit proof-of-concept exists per WPScan, though no active exploitation is confirmed in CISA KEV and the EPSS score of 0.16% reflects the high authentication bar.
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager role to reset the password of any WordPress account - including site administrators - and achieve full account takeover. The flaw stems from a missing per-target authorization check in the password-reset API endpoint, combined with the plugin granting the Outlet Manager role overly broad reset capabilities by default. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.13%, 3rd percentile), suggesting exploitation has not yet been observed at scale.
Blind SQL injection in the appsbd Vitepos (vitepos-lite) WordPress point-of-sale plugin affects all versions up to and including 3.4.2, allowing an authenticated attacker with low privileges to inject crafted SQL into backend database queries and infer data via boolean/time-based responses. The CVSS 3.1 base score of 8.5 reflects a scope change (S:C) with high confidentiality impact, meaning the plugin's SQL context can reach database contents beyond its own security boundary. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthenticated sensitive data exposure in the Vitepos WordPress plugin (versions 3.4.2 and earlier) lets remote attackers read sensitive information without any authentication. The flaw is reported by Patchstack and classified as CWE-201 (information exposure through sent data), with a CVSS 3.1 base score of 7.5 driven entirely by a high confidentiality impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege escalation in the Vitepos WordPress point-of-sale plugin before 3.4.2 lets an authenticated user holding a custom Vitepos role assign themselves the administrator role through an insufficiently restricted user-creation REST API endpoint, resulting in full site takeover. WPScan reports publicly available exploit code exists, though the flaw is not listed in CISA KEV and SSVC records no observed exploitation. With a modest EPSS of 0.24% (14th percentile) but a 'total' technical impact, this is a credentialed-but-realistic escalation path rather than a mass-exploited internet threat.