CVE-2026-109414 Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

PT-2026-69342

Name of the Vulnerable Software and Affected Versions vitepos WordPress plugin versions prior to 3.6.0 Description The point-of-sale password-reset API does not perform a per-target authorization check. Additionally, the custom Outlet Manager role is granted excessive password-reset capabilities ...