Woocommerce Point Of Sale
Approved changes feed: RSS · Atom
cpe:2.3:a:webkul:woocommerce_point_of_sale:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Webkul (08ad6940-8efb-5f93-af42-cb470e3ac46e) |
|---|---|
| Product | Woocommerce Point Of Sale (9de9afca-c5d5-50d5-bd8a-9768e482e950) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-11281 |
vulnerable | 2026-06-08 06:23:49.298308 |
WooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change
CRITICAL (9.8)
The WooCommerce Point of Sale plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0. This is due to insufficient validation on the 'logged_in_user_id' value when option values are empty and the ability for attackers to change the email of arbitrary user accounts. This makes it possible for unauthenticated attackers to change the email of arbitrary user accounts, including administrators, and reset their password to gain access to the account.
Published: 2024-12-25T06:42:12.979Z
Updated: 2026-04-08T16:43:26.182Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.