Executive brief
The Vitepos plugin for WordPress, which provides Point of Sale (POS) functionality, contains a security flaw that allows low-privileged users to grant themselves administrative access. By exploiting a weakness in how the plugin handles new user creation, an attacker with basic access can take full control of the website. This could lead to the theft of customer data, website defacement, or a total shutdown of business operations.
Technical details
A privilege escalation vulnerability exists in the Vitepos WordPress plugin due to improper input validation and authorization checks within a specific REST API endpoint used for user creation. The endpoint fails to restrict the 'role' parameter, allowing an authenticated user (specifically those with custom plugin roles like Outlet Manager) to create new accounts with the 'administrator' role. An attacker can leverage this to gain full administrative control over the WordPress environment. The issue is addressed in version 3.4.2.
Affected products
- Vitepos Vitepos < 3.4.2
Timeline
- 2026-06-01: disclosed: Initial public disclosure by WPScan
- 2026-06-22: advisory: CVE published to NVD
- 2026-06-22: patched: Fixed in version 3.4.2