CVE-2026-14237
N/A
N/A
Summary
The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | vitepos | 3.4.0 < 3.6.0 | affected |
| Unknown | Vitepos | 0 < 3.5.0 | affected |
Weaknesses
- CWE-269 Improper Privilege Management
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.