CVE-2024-13513 Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation
Unauthenticated attackers can extract sensitive tokens from logs to modify user accounts and achieve full site takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-13513?
CVE-2024-13513 is a critical vulnerability in oliverpos Oliver POS – A WooCommerce Point of Sale (POS), published on 15 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2.3 via the logging functionality. This makes it possible for unauthenticated attackers to extract sensitive data including the plugin's clientToken, which in turn can be used to change user account information including emails and account type. This allows attackers to then change account passwords resulting in a complete site takeover. Version 2.4.2.3 disabled logging but left sites with existing log files vulnerable.
Weakness: CWE-862
Which versions are affected by CVE-2024-13513?
It affects 1 product.
Products include Oliverpos Oliver Pos.
How do I fix CVE-2024-13513?
No fix has been published for CVE-2024-13513 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-13513 being exploited?
There is no known exploitation of CVE-2024-13513 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in oliverpos Oliver POS – A WooCommerce Point of Sale (POS)
Sources
Also known as GHSA-v48v-77qp-6x97.