Vitepos
Monthly
Blind SQL injection in the Appsbd Vitepos / vitepos-lite WordPress plugin, affecting versions through 3.6.1, allows an attacker who already holds a high-privilege account on the WordPress site to inject SQL through an improperly neutralized plugin input and extract database contents one inference at a time. The primary barrier is the authentication prerequisite (CVSS PR:H) - exploitation is remote over the network with low complexity and no user interaction, but anonymous internet attackers are excluded, and the attacker must first compromise or legitimately hold an administrative-level session. Patchstack reported the issue with a CVSS 3.1 score of 7.6; the independent assessment narrows the realized impact to loss of confidentiality (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in the Vitepos WordPress point-of-sale plugin through version 3.5.0 lets an authenticated account that already holds a custom or elevated Vitepos role - such as POS staff or manager - raise its own privileges to a higher level on the affected site, rated CVSS 7.2 (High). Exploitation is remote and low-complexity with no user interaction required once such an account exists, but the high-privilege prerequisite (PR:H) means anonymous visitors and ordinary subscriber-level users cannot trigger it, and only WordPress sites with the Vitepos plugin installed and active are exposed. No public exploit code has been identified at time of analysis, and the issue is reported by Patchstack as an improper privilege assignment (CWE-266) defect in the plugin's custom role handling.
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager role to reset the password of any WordPress account - including site administrators - and achieve full account takeover. The flaw stems from a missing per-target authorization check in the password-reset API endpoint, combined with the plugin granting the Outlet Manager role overly broad reset capabilities by default. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.13%, 3rd percentile), suggesting exploitation has not yet been observed at scale.
Blind SQL injection in the appsbd Vitepos (vitepos-lite) WordPress point-of-sale plugin affects all versions up to and including 3.4.2, allowing an authenticated attacker with low privileges to inject crafted SQL into backend database queries and infer data via boolean/time-based responses. The CVSS 3.1 base score of 8.5 reflects a scope change (S:C) with high confidentiality impact, meaning the plugin's SQL context can reach database contents beyond its own security boundary. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthenticated sensitive data exposure in the Vitepos WordPress plugin (versions 3.4.2 and earlier) lets remote attackers read sensitive information without any authentication. The flaw is reported by Patchstack and classified as CWE-201 (information exposure through sent data), with a CVSS 3.1 base score of 7.5 driven entirely by a high confidentiality impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege escalation in the Vitepos WordPress point-of-sale plugin before 3.4.2 lets an authenticated user holding a custom Vitepos role assign themselves the administrator role through an insufficiently restricted user-creation REST API endpoint, resulting in full site takeover. WPScan reports publicly available exploit code exists, though the flaw is not listed in CISA KEV and SSVC records no observed exploitation. With a modest EPSS of 0.24% (14th percentile) but a 'total' technical impact, this is a credentialed-but-realistic escalation path rather than a mass-exploited internet threat.
SQL injection in the vitepos WordPress plugin before version 3.6.0 enables authenticated administrators to exfiltrate database contents via a crafted REST API report request. The vulnerability stems from an unsanitized identifier taken directly from the request body and concatenated into a SQL query, a textbook CWE-89 flaw. A publicly available exploit proof-of-concept exists per WPScan, though no active exploitation is confirmed in CISA KEV and the EPSS score of 0.16% reflects the high authentication bar.
Blind SQL injection in the Appsbd Vitepos / vitepos-lite WordPress plugin, affecting versions through 3.6.1, allows an attacker who already holds a high-privilege account on the WordPress site to inject SQL through an improperly neutralized plugin input and extract database contents one inference at a time. The primary barrier is the authentication prerequisite (CVSS PR:H) - exploitation is remote over the network with low complexity and no user interaction, but anonymous internet attackers are excluded, and the attacker must first compromise or legitimately hold an administrative-level session. Patchstack reported the issue with a CVSS 3.1 score of 7.6; the independent assessment narrows the realized impact to loss of confidentiality (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in the Vitepos WordPress point-of-sale plugin through version 3.5.0 lets an authenticated account that already holds a custom or elevated Vitepos role - such as POS staff or manager - raise its own privileges to a higher level on the affected site, rated CVSS 7.2 (High). Exploitation is remote and low-complexity with no user interaction required once such an account exists, but the high-privilege prerequisite (PR:H) means anonymous visitors and ordinary subscriber-level users cannot trigger it, and only WordPress sites with the Vitepos plugin installed and active are exposed. No public exploit code has been identified at time of analysis, and the issue is reported by Patchstack as an improper privilege assignment (CWE-266) defect in the plugin's custom role handling.
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager role to reset the password of any WordPress account - including site administrators - and achieve full account takeover. The flaw stems from a missing per-target authorization check in the password-reset API endpoint, combined with the plugin granting the Outlet Manager role overly broad reset capabilities by default. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.13%, 3rd percentile), suggesting exploitation has not yet been observed at scale.
Blind SQL injection in the appsbd Vitepos (vitepos-lite) WordPress point-of-sale plugin affects all versions up to and including 3.4.2, allowing an authenticated attacker with low privileges to inject crafted SQL into backend database queries and infer data via boolean/time-based responses. The CVSS 3.1 base score of 8.5 reflects a scope change (S:C) with high confidentiality impact, meaning the plugin's SQL context can reach database contents beyond its own security boundary. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthenticated sensitive data exposure in the Vitepos WordPress plugin (versions 3.4.2 and earlier) lets remote attackers read sensitive information without any authentication. The flaw is reported by Patchstack and classified as CWE-201 (information exposure through sent data), with a CVSS 3.1 base score of 7.5 driven entirely by a high confidentiality impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege escalation in the Vitepos WordPress point-of-sale plugin before 3.4.2 lets an authenticated user holding a custom Vitepos role assign themselves the administrator role through an insufficiently restricted user-creation REST API endpoint, resulting in full site takeover. WPScan reports publicly available exploit code exists, though the flaw is not listed in CISA KEV and SSVC records no observed exploitation. With a modest EPSS of 0.24% (14th percentile) but a 'total' technical impact, this is a credentialed-but-realistic escalation path rather than a mass-exploited internet threat.
SQL injection in the vitepos WordPress plugin before version 3.6.0 enables authenticated administrators to exfiltrate database contents via a crafted REST API report request. The vulnerability stems from an unsanitized identifier taken directly from the request body and concatenated into a SQL query, a textbook CWE-89 flaw. A publicly available exploit proof-of-concept exists per WPScan, though no active exploitation is confirmed in CISA KEV and the EPSS score of 0.16% reflects the high authentication bar.