CVE-2024-0702 Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.1 - Missing Authorization
Authenticated subscribers can perform unauthorized actions like deactivating the plugin or disconnecting subscriptions due to missing capability checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-0702?
CVE-2024-0702 is a high-severity missing authorization vulnerability in oliverpos Oliver POS – A WooCommerce Point of Sale (POS), published on 20 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions hooked via AJAX in the includes/class-pos-bridge-install.php file in all versions up to, and including, 2.4.2.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions like deactivating the plugin, disconnecting the subscription, syncing the status and more.
Weakness: CWE-862
Which versions are affected by CVE-2024-0702?
It affects 1 product.
Products include Oliverpos Oliver Pos.
How do I fix CVE-2024-0702?
No fix has been published for CVE-2024-0702 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-0702 being exploited?
There is no known exploitation of CVE-2024-0702 in the wild and no public exploit code.
Other vulnerabilities in oliverpos Oliver POS – A WooCommerce Point of Sale (POS)
Sources
Also known as GHSA-crwx-4q98-mp2j.