{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/vitepos--point-of-sale-pos-for-woocommerce--3.5.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vitepos:vitepos:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-92766"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Vitepos – Point of Sale (POS) for WooCommerce (\u003c= 3.5.1)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","sqli","wordpress"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Vitepos - Point of Sale (POS) for WooCommerce plugin for WordPress (versions up to and including 3.5.1) contains a critical SQL injection vulnerability identified as CVE-2026-92766. The flaw exists within the /vitepos/v1/vendor/list REST API route, specifically via the 'src_by' parameter. The vulnerability arises from improper input sanitization and a failure to utilize prepared statements when constructing database queries. Furthermore, the permission callback for the vulnerable REST route is insufficient, requiring only a basic POS role assignment (such as vtpos-cashier) rather than standard WordPress administrative privileges. This combination allows unauthenticated or low-privileged users to manipulate back-end database queries, posing a significant risk of data exfiltration or unauthorized database access.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability permits an attacker to perform SQL injection attacks against the underlying WordPress database. This could result in the unauthorized disclosure of sensitive data, including customer information, credentials, or internal configuration data managed by the WooCommerce store. The impact is significant for organizations relying on this plugin for POS operations, as the affected endpoint is publicly reachable by default.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch immediately by updating the Vitepos - Point of Sale (POS) for WooCommerce plugin to the latest version that addresses CVE-2026-92766.\u003c/li\u003e\n\u003cli\u003eReview access logs for web requests targeting the /vitepos/v1/vendor/list endpoint that include suspicious characters (e.g., ;, --, OR, UNION) in the 'src_by' parameter.\u003c/li\u003e\n\u003cli\u003eRestrict access to the WooCommerce REST API for non-administrative roles until the plugin has been patched.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-16T10:26:10Z","date_published":"2026-10-16T10:26:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-vitepos-sqli/","summary":"The Vitepos plugin for WooCommerce is vulnerable to unauthenticated SQL injection via the 'src_by' parameter, potentially allowing unauthorized database information extraction.","title":"SQL Injection in Vitepos POS for WooCommerce","url":"https://feed.craftedsignal.io/briefs/2026-10-vitepos-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Vitepos – Point of Sale (POS) for WooCommerce (\u003c= 3.5.1)","version":"https://jsonfeed.org/version/1.1"}