Sensitive Information Exposure in Oliver POS - WooCommerce Plugin by WordPress
CVE-2024-13513
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 15 February 2025
What is CVE-2024-13513?
The Oliver POS plugin for WooCommerce is susceptible to Sensitive Information Exposure due to its logging functionality, exposing critical data such as client tokens. These tokens enable unauthenticated attackers to manipulate user accounts by changing details like email addresses and account types. Threat actors can further exploit this vulnerability to reset account passwords, leading to potentially compromising entire websites. Although logging was disabled in version 2.4.2.3, existing log files could still harbor sensitive information, making these sites vulnerable.
Affected Version(s)
Oliver POS – A WooCommerce Point of Sale (POS) * <= 2.4.2.3