CVE-2026-14237 — Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation

CVE-2026-14237

Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation PUBLISHED

Description (CNA)

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.

Affected (CNA)

Vendor / product	Versions
Unknown / vitepos	affected 3.4.0 before 3.6.0
Unknown / Vitepos	affected 0 before 3.5.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/7f1eb6ec-c4fb-4c0d-887d-1812a84e29c0/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.