CVE-2026-77183
Received Received - Intake

Privilege Escalation via Account Takeover in FooSales POS for WooCommerce

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Wordfence

Description
The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with FooSales Cashier-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-77183
EUVD
EUVD-2026-96102

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
foosales FooSales – Point of Sale (POS) for WooCommerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The FooSales POS plugin for WordPress has a privilege escalation vulnerability due to improper user identity validation. Authenticated attackers with Cashier-level access or higher can change any user's email, including administrators, then reset passwords to gain full account access.

Detection Guidance

To detect this vulnerability, check for unauthorized changes to user email addresses in WordPress. Review logs for suspicious activity from FooSales Cashier-level accounts or higher. Look for failed login attempts after email changes. Use WordPress admin panel to audit user accounts for unexpected email modifications.

Impact Analysis

Attackers could take over admin accounts, access sensitive data, modify transactions, or perform unauthorized actions. Businesses using this plugin risk financial loss, data breaches, and operational disruption if exploited.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the FooSales – Point of Sale (POS) for WooCommerce plugin to the latest version immediately to patch the vulnerability.

Review user accounts with elevated privileges for unauthorized changes, especially email addresses. Reset passwords for any affected accounts.

Restrict FooSales Cashier-level access to only necessary personnel to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77183. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart