What the vulnerability does
01Description
The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions hooked via AJAX in the includes/class-pos-bridge-install.php file in all versions up to, and including, 2.4.2.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions like deactivating the plugin, disconnecting the subscription, syncing the status and more.
Explanation of Vulnerability in Simple Terms
02Summary
Oliver POS for WooCommerce versions up to 2.4.2.0 lack proper authorization checks, allowing unauthenticated attackers to read sensitive data, modify site content, or disrupt service. The vulnerability requires only network access and no user interaction. Site administrators should update immediately to a version newer than 2.4.2.0.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify content, or disrupt the site without logging in.
Potential impact on your site
04Site Impact
Unauthorized users can access customer data, modify orders, or take the POS system offline.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
February 20, 2024
CVE published
April 8, 2026
Record updated
