CVE-2026-6072
Authorization Bypass in Oliver POS for WooCommerce
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oliver_pos | woocommerce_point_of_sale | to 2.4.2.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Oliver POS WooCommerce Point of Sale plugin for WordPress has a vulnerability called Authorization Bypass Through User-Controlled Key in all versions up to 2.4.2.6.
The plugin protects its REST API endpoints using a permission callback that compares an attacker-supplied 'OliverAuth' header value against a stored authorization token using a loose PHP comparison (==).
On fresh installations where the admin has not completed the connection flow, the stored token is unset (false). Due to PHP type juggling, the comparison '0' == false evaluates to true.
This allows an unauthenticated attacker to bypass authentication by sending the header 'OliverAuth: 0', granting full access to all POS API endpoints.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to bypass authentication and gain full access to all POS API endpoints, enabling them to read user data including administrator details, update user profiles including email addresses, and delete non-admin users.
Such unauthorized access and potential data manipulation can lead to exposure or alteration of personal and sensitive information, which may violate data protection requirements under standards like GDPR and HIPAA.
Additionally, the possibility of an admin account email reset leading to site takeover increases the risk of further unauthorized data access and control.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can gain full access to all POS API endpoints without authentication.
- Read user data, including administrator details.
- Update user profiles, including changing email addresses.
- Delete non-admin users.
By resetting an admin account's email, an attacker can potentially take over the entire site.