Is CVE-2026-54841 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54841 being exploited in the wild.

How severe is CVE-2026-54841?

High severity, with a CVSS score of 7.5, published 25 June 2026.

Is there a fix for CVE-2026-54841?

A patch was published on 2026-06-25: Version 3.4.3 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54841 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54841?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54841: Appsbd Vitepos sensitive data exposure

CVE-2026-54841 · Severity: high · CVSS 7.5 · Published 2026-06-25

Vitepos, a Point of Sale (POS) plugin for WordPress, contains a security flaw that allows unauthorized individuals to access sensitive information. An attacker could exploit this to view data that should be restricted, potentially leading to further compromises of the website or business operations. This issue affects all versions up to 3.4.2 and can be resolved by updating to version 3.4.3.

Quick answers

Is CVE-2026-54841 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54841 being exploited in the wild.
How severe is CVE-2026-54841?: High severity, with a CVSS score of 7.5, published 25 June 2026.
Which products and versions are affected?: Appsbd Vitepos <= 3.4.2.
Is there a fix for CVE-2026-54841?: A patch was published on 2026-06-25: Version 3.4.3 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54841 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54841?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Vitepos plugin (specifically the vitepos-lite package) for WordPress is vulnerable to an unauthenticated sensitive data exposure flaw (CWE-201). The vulnerability exists in versions up to and including 3.4.2. A remote, unauthenticated attacker can exploit this flaw via the network to access sensitive information that is normally restricted. This exposure is classified as high severity because it requires no privileges or user interaction and can facilitate further attacks against the host system. The issue is addressed in version 3.4.3.

Affected products

Appsbd Vitepos <= 3.4.2

Timeline

2026-06-04: disclosed: Reported by qdtad via Patchstack
2026-06-18: advisory: Patchstack published advisory
2026-06-25: advisory: NVD published CVE-2026-54841
2026-06-25: patched: Version 3.4.3 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.