Executive brief
Vitepos is a point-of-sale system plugin for WordPress. The plugin fails to properly check whether a user should be allowed to reset another specific user's password, allowing staff with the "Outlet Manager" role to reset administrator passwords and take over their accounts without additional authorization.
Technical details
The vulnerability is a privilege escalation in the password-reset API endpoint (wp-json/vitepos/v1/user/change-pass-force). The plugin checks only that the current user has the global 'change-any-user-pass' capability (granted by default to the Outlet Manager role) but performs no per-target authorization check before calling wp_set_password() on arbitrary user IDs. An authenticated Outlet Manager can exploit this by sending a POST request with any target user_id to reset that user's password, including administrators. The vulnerability affects Vitepos Pro versions before 3.6.0 and Vitepos Lite before 3.5.0; fixes are available in 3.6.0 and 3.5.0 respectively.
Affected products
- Vitepos Vitepos before 3.6.0
- Vitepos Vitepos Lite before 3.5.0
Timeline
- 2026-08-07: disclosed
- 2026-08-10: advisory