Authorization Bypass Vulnerability in Oliver POS Plugin for WooCommerce by WordPress

CVE-2026-6072

What is CVE-2026-6072?

The Oliver POS plugin for WooCommerce has a significant vulnerability that allows an unauthenticated attacker to bypass authorization through a user-controlled header. This issue arises from a loose PHP comparison used in the permission callback for the POS API, specifically ‘oliver_pos_rest_authentication()’. When the authorization token is not set during the initial setup of the plugin, it allows a malicious user to utilize a value of '0' for the 'OliverAuth' header, resulting in a successful authentication bypass. Once inside, attackers can access sensitive user data, modify profiles, and even reset admin account emails, potentially leading to complete site takeovers.

References