CVE-2024-0702
High
Description
The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions hooked via AJAX in the includes/class-pos-bridge-install.php file in all versions up to, and including, 2.4.2.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions like deactivating the plugin, disconnecting the subscription, syncing the status and more.
SeverityHigh
CVSS7.3
Exploit probability—
ProductOliverpos Oliver Pos
PublishedFeb 29, 2024
First seenFeb 29, 2024
Weakness typeCWE-862Missing authorization
How to fix
Update
- oliverpos oliver_pos2.4.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oliverpos oliver_pos | v < 2.4.2.1 | 2.4.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.