Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by kilbot
CVE-2026-52711 (GCVE-0-2026-52711)
Vulnerability from cvelistv5 – Published: 2026-06-16 09:00 – Updated: 2026-06-16 12:23
VLAI
Title
WordPress WooCommerce POS plugin <= 1.8.14 - Broken Access Control vulnerability
Summary
Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kilbot | WooCommerce POS |
Affected:
n/a , ≤ 1.8.14
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52711",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T12:23:02.345529Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T12:23:19.883Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "woocommerce-pos",
"product": "WooCommerce POS",
"vendor": "kilbot",
"versions": [
{
"changes": [
{
"at": "1.9.0",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.8.14",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Nguyen Ba Khanh | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Access Control in WooCommerce POS \u003c= 1.8.14 versions."
}
],
"value": "Unauthenticated Broken Access Control in WooCommerce POS \u003c= 1.8.14 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T09:00:33.213Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/woocommerce-pos/vulnerability/wordpress-woocommerce-pos-plugin-1-8-14-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WooCommerce POS Plugin to the latest available version (at least 1.9.0)."
}
],
"value": "Update the WordPress WooCommerce POS Plugin to the latest available version (at least 1.9.0)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WooCommerce POS plugin \u003c= 1.8.14 - Broken Access Control vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-52711",
"datePublished": "2026-06-16T09:00:33.213Z",
"dateReserved": "2026-06-08T10:11:13.731Z",
"dateUpdated": "2026-06-16T12:23:19.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45321 (GCVE-0-2026-45321)
Vulnerability from cvelistv5 – Published: 2026-05-12 00:12 – Updated: 2026-05-28 03:55Title
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
Summary
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
Severity
9.6 (Critical)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/TanStack/router/security/advis… | x_refsource_CONFIRM |
| https://github.com/TanStack/router/issues/7383 | x_refsource_MISC |
| https://tanstack.com/blog/npm-supply-chain-compro… | x_refsource_MISC |
| https://www.stepsecurity.io/blog/mini-shai-hulud-… | x_refsource_MISC |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
42 products
| Vendor | Product | Version | |
|---|---|---|---|
| @tanstack | arktype-adapter |
Affected:
1.166.12
Affected: 1.166.15 |
|
| @tanstack | eslint-plugin-router |
Affected:
1.161.9
Affected: 1.161.12 |
|
| @tanstack | eslint-plugin-start |
Affected:
0.0.4
Affected: 0.0.7 |
|
| @tanstack | history |
Affected:
1.161.9
Affected: 1.161.12 |
|
| @tanstack | nitro-v2-vite-plugin |
Affected:
1.154.12
Affected: 1.154.15 |
|
| @tanstack | react-router |
Affected:
1.169.5
Affected: 1.169.8 |
|
| @tanstack | react-router-devtools |
Affected:
1.166.16
Affected: 1.166.19 |
|
| @tanstack | react-router-ssr-query |
Affected:
1.166.15
Affected: 1.166.18 |
|
| @tanstack | react-start |
Affected:
1.167.68
Affected: 1.167.71 |
|
| @tanstack | react-start-client |
Affected:
1.166.51
Affected: 1.166.54 |
|
| @tanstack | react-start-rsc |
Affected:
0.0.47
Affected: 0.0.50 |
|
| @tanstack | react-start-server |
Affected:
1.166.55
Affected: 1.166.58 |
|
| @tanstack | router-cli |
Affected:
1.166.46
Affected: 1.166.49 |
|
| @tanstack | router-core |
Affected:
1.169.5
Affected: 1.169.8 |
|
| @tanstack | router-devtools |
Affected:
1.166.16
Affected: 1.166.19 |
|
| @tanstack | router-devtools-core |
Affected:
1.167.6
Affected: 1.167.9 |
|
| @tanstack | router-generator |
Affected:
1.166.45
Affected: 1.166.48 |
|
| @tanstack | router-plugin |
Affected:
1.167.38
Affected: 1.167.41 |
|
| @tanstack | router-ssr-query-core |
Affected:
1.168.3
Affected: 1.168.6 |
|
| @tanstack | router-utils |
Affected:
1.161.11
Affected: 1.161.14 |
|
| @tanstack | outer-vite-plugin |
Affected:
1.166.53
Affected: 1.166.56 |
|
| @tanstack | solid-router |
Affected:
1.169.5
Affected: 1.169.8 |
|
| @tanstack | solid-router-devtools |
Affected:
1.166.16
Affected: 1.166.19 |
|
| @tanstack | solid-router-ssr-query |
Affected:
1.166.15
Affected: 1.166.18 |
|
| @tanstack | solid-start |
Affected:
1.167.65
Affected: 1.167.68 |
|
| @tanstack | solid-start-client |
Affected:
1.166.50
Affected: 1.166.53 |
|
| @tanstack | solid-start-server |
Affected:
1.166.54
Affected: 1.166.57 |
|
| @tanstack | start-client-core |
Affected:
1.168.5
Affected: 1.168.8 |
|
| @tanstack | start-fn-stubs |
Affected:
1.161.9
Affected: 1.161.12 |
|
| @tanstack | start-plugin-core |
Affected:
1.169.23
Affected: 1.169.26 |
|
| @tanstack | start-server-core |
Affected:
1.167.33
Affected: 1.167.36 |
|
| @tanstack | start-static-server-functions |
Affected:
1.166.44
Affected: 1.166.47 |
|
| @tanstack | start-storage-context |
Affected:
1.166.38
Affected: 1.166.41 |
|
| @tanstack | valibot-adapter |
Affected:
1.166.12
Affected: 1.166.15 |
|
| @tanstack | virtual-file-routes |
Affected:
1.161.10
Affected: 1.161.13 |
|
| @tanstack | vue-router |
Affected:
1.169.5
Affected: 1.169.8 |
|
| @tanstack | vue-router-devtools |
Affected:
1.166.16
Affected: 1.166.19 |
|
| @tanstack | vue-router-ssr-query |
Affected:
1.166.15
Affected: 1.166.18 |
|
| @tanstack | vue-start |
Affected:
1.167.61
Affected: 1.167.64 |
|
| @tanstack | vue-start-client |
Affected:
1.166.46
Affected: 1.166.49 |
|
| @tanstack | vue-start-server |
Affected:
1.166.50
Affected: 1.166.53 |
|
| @tanstack | zod-adapter |
Affected:
1.166.12
Affected: 1.166.15 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45321",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-05-27",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T03:55:26.991Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-45321"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-27T00:00:00.000Z",
"value": "CVE-2026-45321 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "arktype-adapter",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.12"
},
{
"status": "affected",
"version": "1.166.15"
}
]
},
{
"product": "eslint-plugin-router",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.161.9"
},
{
"status": "affected",
"version": "1.161.12"
}
]
},
{
"product": "eslint-plugin-start",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "0.0.4"
},
{
"status": "affected",
"version": "0.0.7"
}
]
},
{
"product": "history",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.161.9"
},
{
"status": "affected",
"version": "1.161.12"
}
]
},
{
"product": "nitro-v2-vite-plugin",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.154.12"
},
{
"status": "affected",
"version": "1.154.15"
}
]
},
{
"product": "react-router",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.169.5"
},
{
"status": "affected",
"version": "1.169.8"
}
]
},
{
"product": "react-router-devtools",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.16"
},
{
"status": "affected",
"version": "1.166.19"
}
]
},
{
"product": "react-router-ssr-query",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.15"
},
{
"status": "affected",
"version": "1.166.18"
}
]
},
{
"product": "react-start",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.167.68"
},
{
"status": "affected",
"version": "1.167.71"
}
]
},
{
"product": "react-start-client",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.51"
},
{
"status": "affected",
"version": "1.166.54"
}
]
},
{
"product": "react-start-rsc",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "0.0.47"
},
{
"status": "affected",
"version": "0.0.50"
}
]
},
{
"product": "react-start-server",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.55"
},
{
"status": "affected",
"version": "1.166.58"
}
]
},
{
"product": "router-cli",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.46"
},
{
"status": "affected",
"version": "1.166.49"
}
]
},
{
"product": "router-core",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.169.5"
},
{
"status": "affected",
"version": "1.169.8"
}
]
},
{
"product": "router-devtools",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.16"
},
{
"status": "affected",
"version": "1.166.19"
}
]
},
{
"product": "router-devtools-core",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.167.6"
},
{
"status": "affected",
"version": "1.167.9"
}
]
},
{
"product": "router-generator",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.45"
},
{
"status": "affected",
"version": "1.166.48"
}
]
},
{
"product": "router-plugin",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.167.38"
},
{
"status": "affected",
"version": "1.167.41"
}
]
},
{
"product": "router-ssr-query-core",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.168.3"
},
{
"status": "affected",
"version": "1.168.6"
}
]
},
{
"product": "router-utils",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.161.11"
},
{
"status": "affected",
"version": "1.161.14"
}
]
},
{
"product": "outer-vite-plugin",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.53"
},
{
"status": "affected",
"version": "1.166.56"
}
]
},
{
"product": "solid-router",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.169.5"
},
{
"status": "affected",
"version": "1.169.8"
}
]
},
{
"product": "solid-router-devtools",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.16"
},
{
"status": "affected",
"version": "1.166.19"
}
]
},
{
"product": "solid-router-ssr-query",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.15"
},
{
"status": "affected",
"version": "1.166.18"
}
]
},
{
"product": "solid-start",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.167.65"
},
{
"status": "affected",
"version": "1.167.68"
}
]
},
{
"product": "solid-start-client",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.50"
},
{
"status": "affected",
"version": "1.166.53"
}
]
},
{
"product": "solid-start-server",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.54"
},
{
"status": "affected",
"version": "1.166.57"
}
]
},
{
"product": "start-client-core",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.168.5"
},
{
"status": "affected",
"version": "1.168.8"
}
]
},
{
"product": "start-fn-stubs",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.161.9"
},
{
"status": "affected",
"version": "1.161.12"
}
]
},
{
"product": "start-plugin-core",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.169.23"
},
{
"status": "affected",
"version": "1.169.26"
}
]
},
{
"product": "start-server-core",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.167.33"
},
{
"status": "affected",
"version": "1.167.36"
}
]
},
{
"product": "start-static-server-functions",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.44"
},
{
"status": "affected",
"version": "1.166.47"
}
]
},
{
"product": "start-storage-context",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.38"
},
{
"status": "affected",
"version": "1.166.41"
}
]
},
{
"product": "valibot-adapter",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.12"
},
{
"status": "affected",
"version": "1.166.15"
}
]
},
{
"product": "virtual-file-routes",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.161.10"
},
{
"status": "affected",
"version": "1.161.13"
}
]
},
{
"product": "vue-router",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.169.5"
},
{
"status": "affected",
"version": "1.169.8"
}
]
},
{
"product": "vue-router-devtools",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.16"
},
{
"status": "affected",
"version": "1.166.19"
}
]
},
{
"product": "vue-router-ssr-query",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.15"
},
{
"status": "affected",
"version": "1.166.18"
}
]
},
{
"product": "vue-start",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.167.61"
},
{
"status": "affected",
"version": "1.167.64"
}
]
},
{
"product": "vue-start-client",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.46"
},
{
"status": "affected",
"version": "1.166.49"
}
]
},
{
"product": "vue-start-server",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.50"
},
{
"status": "affected",
"version": "1.166.53"
}
]
},
{
"product": "zod-adapter",
"vendor": "@tanstack",
"versions": [
{
"status": "affected",
"version": "1.166.12"
},
{
"status": "affected",
"version": "1.166.15"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes \u2014 a pull_request_target \"Pwn Request\" misconfiguration, GitHub Actions cache poisoning across the fork\u2194base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process \u2014 to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T15:16:17.354Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx"
},
{
"name": "https://github.com/TanStack/router/issues/7383",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/TanStack/router/issues/7383"
},
{
"name": "https://tanstack.com/blog/npm-supply-chain-compromise-postmortem",
"tags": [
"x_refsource_MISC"
],
"url": "https://tanstack.com/blog/npm-supply-chain-compromise-postmortem"
},
{
"name": "https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem"
}
],
"source": {
"advisory": "GHSA-g7cv-rxg3-hmpx",
"discovery": "UNKNOWN"
},
"title": "Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45321",
"datePublished": "2026-05-12T00:12:35.452Z",
"dateReserved": "2026-05-11T20:50:30.539Z",
"dateUpdated": "2026-05-28T03:55:26.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48117 (GCVE-0-2025-48117)
Vulnerability from cvelistv5 – Published: 2025-05-16 15:45 – Updated: 2026-05-12 00:16
VLAI
Title
WordPress WooCommerce POS plugin <= 1.7.8 - Broken Access Control Vulnerability
Summary
Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce POS: from n/a through <= 1.7.8.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/Wordpress/Plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kilbot | WooCommerce POS |
Affected:
0 , ≤ 1.7.8
(custom)
|
Date Public
2026-04-01 16:40
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-48117",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-16T16:37:40.290138Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T00:16:44.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "woocommerce-pos",
"product": "WooCommerce POS",
"vendor": "kilbot",
"versions": [
{
"changes": [
{
"at": "1.7.9",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.7.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marek Mikita | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-04-01T16:40:26.144Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects WooCommerce POS: from n/a through \u003c= 1.7.8.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce POS: from n/a through \u003c= 1.7.8."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:12:51.843Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/woocommerce-pos/vulnerability/wordpress-woocommerce-pos-1-7-8-broken-access-control-vulnerability?_s_id=cve"
}
],
"title": "WordPress WooCommerce POS plugin \u003c= 1.7.8 - Broken Access Control Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2025-48117",
"datePublished": "2025-05-16T15:45:09.119Z",
"dateReserved": "2025-05-15T18:01:15.809Z",
"dateUpdated": "2026-05-12T00:16:44.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-2384 (GCVE-0-2024-2384)
Vulnerability from cvelistv5 – Published: 2024-03-20 02:35 – Updated: 2026-04-08 17:26
VLAI
Title
WooCommerce POS <= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure
Summary
The WooCommerce POS plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.4.11. This is due to the plugin not properly verifying the authentication and authorization of the current user This makes it possible for authenticated attackers, with customer-level access and above, to view potentially sensitive information about other users by leveraging their order id
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kilbot | WCPOS – Point of Sale (POS) plugin for WooCommerce |
Affected:
0 , ≤ 1.4.11
(semver)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T19:11:53.517Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d6b8ba69-aa8b-436f-990c-39e283f5d2f2?source=cve"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3053833%40woocommerce-pos\u0026new=3053833%40woocommerce-pos\u0026sfp_email=\u0026sfph_mail="
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-2384",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-01T19:23:24.378518Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-01T19:23:33.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WCPOS \u2013 Point of Sale (POS) plugin for WooCommerce",
"vendor": "kilbot",
"versions": [
{
"lessThanOrEqual": "1.4.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lucio S\u00e1"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WooCommerce POS plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.4.11. This is due to the plugin not properly verifying the authentication and authorization of the current user This makes it possible for authenticated attackers, with customer-level access and above, to view potentially sensitive information about other users by leveraging their order id"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:26:25.925Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d6b8ba69-aa8b-436f-990c-39e283f5d2f2?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3053833%40woocommerce-pos\u0026new=3053833%40woocommerce-pos\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2024-03-19T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "WooCommerce POS \u003c= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-2384",
"datePublished": "2024-03-20T02:35:41.744Z",
"dateReserved": "2024-03-11T16:21:16.026Z",
"dateUpdated": "2026-04-08T17:26:25.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}