What the vulnerability does
01Description
The Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) plugin for WordPress is vulnerable to privilege escalation via insecure token-based authentication in all versions up to, and including, 1.11.0. This is due to the plugin trusting a user-supplied Base64-encoded user ID in the token parameter to identify users, leaking valid authentication tokens through the 'barcodeScannerConfigs' action, and lacking meta-key restrictions on the 'setUserMeta' action. This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator by first spoofing the admin user ID to leak their authentication token, then using that token to update any user's 'wp_capabilities' meta to gain full administrative access.
Explanation of Vulnerability in Simple Terms
02Summary
Barcode Scanner versions up to 1.11.0 contain a privilege management flaw that allows unauthenticated attackers to read, modify, or delete data and disrupt service. The vulnerability requires no user interaction and is exploitable over the network. Organizations using this product should update immediately to a patched version.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete data; disrupt service availability without authentication.
Potential impact on your site
04Site Impact
Attackers can access inventory, orders, and POS data; modify records; or take the system offline.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 15, 2026
CVE published
April 16, 2026
Record updated
