Cpe:2.3:a:vitepos:vitepos:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aviteposviteposwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 10:26:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection in Vitepos POS for WooCommercehttps://feed.craftedsignal.io/briefs/2026-10-vitepos-sqli/Fri, 16 Oct 2026 10:26:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-vitepos-sqli/The Vitepos plugin for WooCommerce is vulnerable to unauthenticated SQL injection via the 'src_by' parameter, potentially allowing unauthorized database information extraction.The Vitepos - Point of Sale (POS) for WooCommerce plugin for WordPress (versions up to and including 3.5.1) contains a critical SQL injection vulnerability identified as CVE-2026-92766. The flaw exists within the /vitepos/v1/vendor/list REST API route, specifically via the 'src_by' parameter. The vulnerability arises from improper input sanitization and a failure to utilize prepared statements when constructing database queries. Furthermore, the permission callback for the vulnerable REST route is insufficient, requiring only a basic POS role assignment (such as vtpos-cashier) rather than standard WordPress administrative privileges. This combination allows unauthenticated or low-privileged users to manipulate back-end database queries, posing a significant risk of data exfiltration or unauthorized database access.

Impact

Successful exploitation of this vulnerability permits an attacker to perform SQL injection attacks against the underlying WordPress database. This could result in the unauthorized disclosure of sensitive data, including customer information, credentials, or internal configuration data managed by the WooCommerce store. The impact is significant for organizations relying on this plugin for POS operations, as the affected endpoint is publicly reachable by default.

Recommendation

  1. Patch immediately by updating the Vitepos - Point of Sale (POS) for WooCommerce plugin to the latest version that addresses CVE-2026-92766.
  2. Review access logs for web requests targeting the /vitepos/v1/vendor/list endpoint that include suspicious characters (e.g., ;, --, OR, UNION) in the 'src_by' parameter.
  3. Restrict access to the WooCommerce REST API for non-administrative roles until the plugin has been patched.
]]>highadvisoryweb-application-vulnerabilitysqliwordpress