PT-2026-33185 · WordPress · Barcode Scanner

Jude Nwadinobi · Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-4880

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) plugin for WordPress versions prior to 1.11.1

Description Insecure token-based authentication allows unauthenticated attackers to escalate privileges to administrator. The issue stems from the plugin trusting a user-supplied Base64-encoded user ID within the token parameter to identify users. Additionally, valid authentication tokens are leaked through the 'barcodeScannerConfigs' action, and the 'setUserMeta' action lacks meta-key restrictions. An attacker can spoof an administrator user ID to leak their authentication token and subsequently use that token to update the wp capabilities meta of any user to gain full administrative access.

Recommendations Update to a version newer than 1.11.0.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-4880

Affected Products

Barcode Scanner

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-4880 · Security Note
• https://twitter.com/CVEnew/status/2044701600359551424 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3506824/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders#file30 · Note
• https://twitter.com/0dayPublishing/status/2044561329118138497 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044664033605812689 · Twitter Post
• https://plugins.trac.wordpress.org/browser/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/trunk/src/Core.php?rev=3391688#L498 · Note
• https://twitter.com/OrizonCyber/status/2044589134748979638 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a213e844-a0d3-4123-9f72-caef7702804c?source=cve · Note