CVE-2026-4880criticalCWE-269

CVE-2026-4880: fallo crítico en ukrsolution Barcode Scanner (+Mobile App)…

Barcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Barcode Scanner – Inventory manager, Order fulfillment system, POS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 0.5%
The Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) plugin for WordPress is vulnerable to privilege escalation via insecure token-based authentication in all versions up to, and including, 1.11.0. This is due to the plugin trusting a user-supplied Base64-encoded user ID in the token parameter to identify users, leaking valid authentication tokens through the 'barcodeScannerConfigs' action, and lacking meta-key restrictions on the 'setUserMeta' action. This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator by first spoofing the admin user ID to leak their authentication token, then using that token to update any user's 'wp_capabilities' meta to gain full administrative access.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
ukrsolution · Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)
CVEs relacionadas — ukrsolution Barcode Scanner (+Mobile App)…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-2661HIGHBarcode Scanner with Inventory & Order Manager <= 1.5.4 - Authenticated (Subscriber+) SQL InjectionEPSS 0.6%