Oliver Pos Vulnerabilities

The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.4.2.6. The plugin protects its entire /wp-json/pos-bridge/* REST API namespace through the oliver_pos_rest_authentication() permission callback,...

CVSS:

6.5

Affected:

up to 2.4.2.6

Fixed in:

4.5.4

Disclosed:

May 19, 2026

CVE-2026-6072 on NVD →

The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2.3 via the logging functionality. This makes it possible for unauthenticated attackers to extract sensitive data including the plugin's clientToken, which in...

CVSS:

9.8

Affected:

up to 2.4.2.3

Fixed in:

2.4.2.4

Disclosed:

Feb 14, 2025

CVE-2024-13513 on NVD →

The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1.8. This is due to missing or incorrect nonce validation in the includes/class-pos-bridge-install.php file. This makes it possible for unauthenticated attackers...

CVSS:

6.3

Affected:

up to 2.4.1.8

Fixed in:

2.4.1.9

Disclosed:

Feb 27, 2024

CVE-2024-1954 on NVD →

The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions hooked via AJAX in the includes/class-pos-bridge-install.php file in all versions up to, and including, 2.4.2.1 This makes it possible for authenticated atta...

CVSS:

7.3

Affected:

up to 2.4.2.0

Fixed in:

2.4.2.1

Disclosed:

Feb 19, 2024

CVE-2024-0702 on NVD →