High severity7.3NVD Advisory· Published Feb 29, 2024· Updated Apr 8, 2026

CVE-2024-0702

Description

The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions hooked via AJAX in the includes/class-pos-bridge-install.php file in all versions up to, and including, 2.4.2.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions like deactivating the plugin, disconnecting the subscription, syncing the status and more.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Oliverpos/Oliver Pos
cpe:2.3:a:oliverpos:oliver_pos:*:*:*:*:*:wordpress:*:*
Range: <2.4.2.1
WordPress/Oliver Posllm-fuzzy
Range: <=2.4.2.1
Package: https://wordpress.org/plugins/oliver-pos

Patches

Vulnerability mechanics

References

www.wordfence.com/threat-intel/vulnerabilities/id/b5c6f351-477b-4384-9863-fe3b45ddf21dnvdThird Party Advisory
plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/class-pos-bridge-install.phpnvdProduct
plugins.trac.wordpress.org/changesetnvd

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000