Unauthorized Access Vulnerability in Oliver POS Plugin for WordPress

CVE-2024-0702

Summary

The Oliver POS plugin for WooCommerce, a widely used point of sale solution for WordPress, is vulnerable to unauthorized access due to insufficient capability checks in its AJAX functions. This flaw, located in the includes/class-pos-bridge-install.php file, allows authenticated attackers with subscriber-level access or higher to exploit several sensitive functionalities. Actions such as deactivating the plugin, disconnecting user subscriptions, and altering synchronization status can be executed without adequate permissions, potentially compromising overall plugin integrity and user trust.

References