CVE-2024-0702

2024-02-2901:43:25

[email protected]

web.nvd.nist.gov

oliver pos

woocommerce

point of sale

pos

plugin

wordpress

vulnerability

unauthorized access

capability checks

ajax

security advisory

cve-2024-0702

nvd

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions hooked via AJAX in the includes/class-pos-bridge-install.php file in all versions up to, and including, 2.4.1.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions like deactivating the plugin, disconnecting the subscription, syncing the status and more.

Affected configurations

Vulners

Node

oliverposoliver_pos_–_a_woocommerce_point_of_sale_\(pos\)Range≤2.4.1.8

CNA Affected

[
  {
    "vendor": "oliverpos",
    "product": "Oliver POS – A WooCommerce Point of Sale (POS)",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "2.4.1.8",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]