Quick answers
- Is CVE-2026-14237 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14237 being exploited in the wild.
- How severe is CVE-2026-14237?
- High severity, with a CVSS score of 7.2, published 10 August 2026.
- Which products and versions are affected?
- Vitepos before 3.6.0; Vitepos Lite before 3.5.0.
- Is there a fix for CVE-2026-14237?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-14237 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-14237?
- Check whether you run Vitepos or Vitepos Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a privilege escalation in the password-reset API endpoint (wp-json/vitepos/v1/user/change-pass-force). The plugin checks only that the current user has the global 'change-any-user-pass' capability (granted by default to the Outlet Manager role) but performs no per-target authorization check before calling wp_set_password() on arbitrary user IDs. An authenticated Outlet Manager can exploit this by sending a POST request with any target user_id to reset that user's password, including administrators. The vulnerability affects Vitepos Pro versions before 3.6.0 and Vitepos Lite before 3.5.0; fixes are available in 3.6.0 and 3.5.0 respectively.
Affected products
- Vitepos Vitepos before 3.6.0
- Vitepos Vitepos Lite before 3.5.0
Timeline
- 2026-08-07: disclosed
- 2026-08-10: advisory