CVE-2026-6072 (GCVE-0-2026-6072)

Vulnerability from cvelistv5 – Published: 2026-05-20 01:25 – Updated: 2026-05-20 13:13
VLAI
Title
Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header
Summary
The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.4.2.6. The plugin protects its entire /wp-json/pos-bridge/* REST API namespace through the oliver_pos_rest_authentication() permission callback, which uses a loose PHP comparison (==) to compare the attacker-supplied 'OliverAuth' header value against the 'oliver_pos_authorization_token' option. On fresh installations where the admin has not yet completed the connection flow, this option is unset (get_option returns false). Due to PHP's type juggling, the loose comparison '0' == false evaluates to true, allowing an unauthenticated attacker to bypass authentication by sending 'OliverAuth: 0'. This grants full access to all POS API endpoints, enabling attackers to read user data (including administrator details), update user profiles (including email addresses), and delete non-admin users. An admin account email reset can lead to site takeover.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-20 13:13 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Wordfence CNA under the mitre root
CNA scorecard C 65/100 over 2108 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
oliverpos Oliver POS – A WooCommerce Point of Sale (POS) Affected: 0 , ≤ 2.4.2.6 (semver)
guessed Create a notification for this product.
Credits
Hunter Jensen
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6072",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-20T13:13:44.799243Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-20T13:13:52.305Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Oliver POS \u2013 A WooCommerce Point of Sale (POS)",
          "vendor": "oliverpos",
          "versions": [
            {
              "lessThanOrEqual": "2.4.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hunter Jensen"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Oliver POS \u2013 A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.4.2.6. The plugin protects its entire /wp-json/pos-bridge/* REST API namespace through the oliver_pos_rest_authentication() permission callback, which uses a loose PHP comparison (==) to compare the attacker-supplied \u0027OliverAuth\u0027 header value against the \u0027oliver_pos_authorization_token\u0027 option. On fresh installations where the admin has not yet completed the connection flow, this option is unset (get_option returns false). Due to PHP\u0027s type juggling, the loose comparison \u00270\u0027 == false evaluates to true, allowing an unauthenticated attacker to bypass authentication by sending \u0027OliverAuth: 0\u0027. This grants full access to all POS API endpoints, enabling attackers to read user data (including administrator details), update user profiles (including email addresses), and delete non-admin users. An admin account email reset can lead to site takeover."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-20T01:25:54.241Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca6aa922-9c58-445c-b88a-3d1d1c95102c?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge.php#L1679"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge.php#L1679"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge.php#L1677"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge.php#L1677"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L170"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L170"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L195"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L195"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L231"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L231"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-19T12:03:04.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Oliver POS \u003c= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to \u0027OliverAuth\u0027 Header"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-6072",
    "datePublished": "2026-05-20T01:25:54.241Z",
    "dateReserved": "2026-04-10T14:00:15.790Z",
    "dateUpdated": "2026-05-20T13:13:52.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-6072",
      "date": "2026-10-08",
      "epss": "0.0061",
      "percentile": "0.47565"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Oliver POS \u2013 A WooCommerce Point of Sale (POS)",
                "vendor": "oliverpos",
                "versions": [
                  {
                    "lessThanOrEqual": "2.4.2.6",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@wordfence.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The Oliver POS \u2013 A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.4.2.6. The plugin protects its entire /wp-json/pos-bridge/* REST API namespace through the oliver_pos_rest_authentication() permission callback, which uses a loose PHP comparison (==) to compare the attacker-supplied \u0027OliverAuth\u0027 header value against the \u0027oliver_pos_authorization_token\u0027 option. On fresh installations where the admin has not yet completed the connection flow, this option is unset (get_option returns false). Due to PHP\u0027s type juggling, the loose comparison \u00270\u0027 == false evaluates to true, allowing an unauthenticated attacker to bypass authentication by sending \u0027OliverAuth: 0\u0027. This grants full access to all POS API endpoints, enabling attackers to read user data (including administrator details), update user profiles (including email addresses), and delete non-admin users. An admin account email reset can lead to site takeover."
          },
          {
            "lang": "es",
            "value": "El plugin Oliver POS - Un Punto de Venta (POS) de WooCommerce para WordPress es vulnerable a la Omisi\u00f3n de autorizaci\u00f3n mediante clave controlada por el usuario en todas las versiones hasta la 2.4.2.6 inclusive. El plugin protege todo su espacio de nombres de la API REST /wp-json/pos-bridge/* a trav\u00e9s de la funci\u00f3n de devoluci\u00f3n de llamada de permiso oliver_pos_rest_authentication(), que utiliza una comparaci\u00f3n PHP laxa (==) para comparar el valor del encabezado \u0027OliverAuth\u0027 proporcionado por el atacante con la opci\u00f3n \u0027oliver_pos_authorization_token\u0027. En instalaciones nuevas donde el administrador a\u00fan no ha completado el flujo de conexi\u00f3n, esta opci\u00f3n no est\u00e1 configurada (get_option devuelve falso). Debido a la manipulaci\u00f3n de tipos de PHP, la comparaci\u00f3n laxa \u00270\u0027 == false se eval\u00faa como verdadera, permitiendo a un atacante no autenticado omitir la autenticaci\u00f3n enviando \u0027OliverAuth: 0\u0027. Esto otorga acceso completo a todos los puntos finales de la API de POS, permitiendo a los atacantes leer datos de usuario (incluidos los detalles del administrador), actualizar perfiles de usuario (incluidas las direcciones de correo electr\u00f3nico) y eliminar usuarios no administradores. Un restablecimiento de correo electr\u00f3nico de cuenta de administrador puede llevar a la toma de control del sitio."
          }
        ],
        "id": "CVE-2026-6072",
        "lastModified": "2026-07-24T08:10:00.150",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 4.2,
              "source": "security@wordfence.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-6072",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-20T13:13:44.799243Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-20T02:16:37.207",
        "references": [
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L170"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L195"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L231"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge.php#L1677"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge.php#L1679"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L170"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L195"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L231"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge.php#L1677"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge.php#L1679"
          },
          {
            "source": "security@wordfence.com",
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca6aa922-9c58-445c-b88a-3d1d1c95102c?source=cve"
          }
        ],
        "sourceIdentifier": "security@wordfence.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "security@wordfence.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:32:20+00:00",
      "cve": "CVE-2026-6072",
      "id": "CVE-2026-6072",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Oliver POS \u003c= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to \u0027OliverAuth\u0027 Header",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6072.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-6072",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-20T13:13:44.799243Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-20T13:13:49.072Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Oliver POS \u2013 A WooCommerce Point of Sale (POS)",
              "vendor": "oliverpos",
              "versions": [
                {
                  "lessThanOrEqual": "2.4.2.6",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Hunter Jensen"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "The Oliver POS \u2013 A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 2.4.2.6. The plugin protects its entire /wp-json/pos-bridge/* REST API namespace through the oliver_pos_rest_authentication() permission callback, which uses a loose PHP comparison (==) to compare the attacker-supplied \u0027OliverAuth\u0027 header value against the \u0027oliver_pos_authorization_token\u0027 option. On fresh installations where the admin has not yet completed the connection flow, this option is unset (get_option returns false). Due to PHP\u0027s type juggling, the loose comparison \u00270\u0027 == false evaluates to true, allowing an unauthenticated attacker to bypass authentication by sending \u0027OliverAuth: 0\u0027. This grants full access to all POS API endpoints, enabling attackers to read user data (including administrator details), update user profiles (including email addresses), and delete non-admin users. An admin account email reset can lead to site takeover."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-20T01:25:54.241Z",
            "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
            "shortName": "Wordfence"
          },
          "references": [
            {
              "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ca6aa922-9c58-445c-b88a-3d1d1c95102c?source=cve"
            },
            {
              "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge.php#L1679"
            },
            {
              "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge.php#L1679"
            },
            {
              "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge.php#L1677"
            },
            {
              "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge.php#L1677"
            },
            {
              "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L170"
            },
            {
              "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L170"
            },
            {
              "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L195"
            },
            {
              "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L195"
            },
            {
              "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-user.php#L231"
            },
            {
              "url": "https://plugins.trac.wordpress.org/browser/oliver-pos/tags/2.4.2.6/includes/class-pos-bridge-user.php#L231"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-05-19T12:03:04.000Z",
              "value": "Disclosed"
            }
          ],
          "title": "Oliver POS \u003c= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to \u0027OliverAuth\u0027 Header"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "assignerShortName": "Wordfence",
        "cveId": "CVE-2026-6072",
        "datePublished": "2026-05-20T01:25:54.241Z",
        "dateReserved": "2026-04-10T14:00:15.790Z",
        "dateUpdated": "2026-05-20T13:13:52.305Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.