Junglewise Threat Intelligence

CVE-2026-6072: Oliver POS WordPress plugin authentication bypass in REST API

CVE-2026-6072 · Severity: medium · CVSS 6.5 · Published 2026-05-20

Executive brief

Oliver POS is a WordPress plugin that connects WooCommerce stores to physical point-of-sale systems. A security flaw allows unauthenticated attackers to bypass authentication on new or unconfigured installations. This could allow an attacker to view sensitive customer and administrator data, modify user profiles, or potentially take over the entire website by changing the administrator's email address.

Technical details

The Oliver POS plugin for WordPress (versions up to 2.4.2.6) contains an authentication bypass in the oliver_pos_rest_authentication() permission callback. The vulnerability stems from the use of a loose PHP comparison (==) when validating the 'OliverAuth' header against the 'oliver_pos_authorization_token' option. On fresh installations where this token is not yet set, get_option returns false; due to PHP type juggling, a header value of '0' evaluates as true against a false value. An unauthenticated remote attacker can exploit this to access the /wp-json/pos-bridge/* REST API namespace, allowing them to read administrator details, update user emails, and delete non-admin users.

Affected products

  • Oliver POS Oliver POS – A WooCommerce Point of Sale (POS) plugin Up to and including 2.4.2.6

Timeline

  • 2026-05-20: advisory: NVD publication date

References