PT-2026-42058 · Oliverpos · Oliver Pos – A Woocommerce Point Of Sale
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Oliver POS versions prior to 2.4.2.7
Description
An authorization bypass exists in the plugin due to the use of a loose PHP comparison (==) within the
oliver pos rest authentication() permission callback. This function compares the OliverAuth header value provided by the user with the oliver pos authorization token option. In new installations where the administrator has not completed the connection flow, the token option is unset and returns false. Because of PHP type juggling, providing the value '0' in the OliverAuth header evaluates to true, allowing unauthenticated access to the /wp-json/pos-bridge/* REST API namespace. This allows attackers to read user data, including administrator details, update user profiles, and delete non-administrator users. Changing an administrator's email address can lead to full site takeover.Recommendations
Update Oliver POS to version 2.4.2.7 or later.
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Oliver Pos – A Woocommerce Point Of Sale