What the vulnerability does
01Description
The WooCommerce Point of Sale plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0. This is due to insufficient validation on the 'logged_in_user_id' value when option values are empty and the ability for attackers to change the email of arbitrary user accounts. This makes it possible for unauthenticated attackers to change the email of arbitrary user accounts, including administrators, and reset their password to gain access to the account.
Explanation of Vulnerability in Simple Terms
02Summary
WooCommerce Point of Sale versions 6.1.0 and earlier lack proper authorization checks, allowing unauthenticated attackers to perform sensitive operations without valid credentials. An attacker can read, modify, or delete data and functionality across the application by sending direct requests to unprotected endpoints. This affects all installations without a security update.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete data and perform administrative actions without any authentication.
Potential impact on your site
04Site Impact
Attackers can compromise customer data, orders, inventory, and site configuration without logging in.
Conditions required to exploit
05Prerequisites
Network access to the affected WooCommerce Point of Sale installation; no authentication or user interaction required.
Key dates
06Disclosure timeline
December 25, 2024
CVE published
April 8, 2026
Record updated
