CVE-2024-0702 HIGH

CVE-2024-0702: Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.1 - Missing Authorization

Vendor Oliverpos
Product Oliver POS – A WooCommerce Point of Sale (POS)
Weakness CWE-862 · Missing authorization
Published February 20, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

7.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions hooked via AJAX in the includes/class-pos-bridge-install.php file in all versions up to, and including, 2.4.2.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions like deactivating the plugin, disconnecting the subscription, syncing the status and more.

Key dates

02Disclosure timeline

February 20, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-10753 OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 - Missing Authorization CVE-2024-1844 RevivePress – Keep your Old Content Evergreen <= 1.5.6 - Missing Authorization CVE-2024-10664 Knowledge Base documentation & wiki plugin – BasePress Docs <= 2.16.3.3 - Missing Authorization to Authenticated (Subscriber+) Database Update CVE-2026-21429 Emlog has Broken Access Control (BAC) CVE-2021-24184 Tutor LMS < 1.7.7 - Unprotected AJAX including Privilege Escalation