High severity7.3NVD Advisory· Published Feb 29, 2024· Updated Apr 8, 2026

CVE-2024-0702

Description

The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions hooked via AJAX in the includes/class-pos-bridge-install.php file in all versions up to, and including, 2.4.2.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions like deactivating the plugin, disconnecting the subscription, syncing the status and more.

Affected products

Oliverpos/Oliver Pos
cpe:2.3:a:oliverpos:oliver_pos:*:*:*:*:*:wordpress:*:*
Range: <2.4.2.1

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.wordfence.com/threat-intel/vulnerabilities/id/b5c6f351-477b-4384-9863-fe3b45ddf21dnvdThird Party Advisory
plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-install.phpnvdProduct
plugins.trac.wordpress.org/changesetnvd

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000