A critical privilege management vulnerability in the vitepos WordPress plugin allows unauthorized password resets of administrative accounts.

This vulnerability involves improper privilege management within the point-of-sale password-reset API. The plugin fails to perform necessary per-target authorization checks and grants the Outlet Manager role excessive capabilities, enabling them to reset passwords for any user, including administrators.

This flaw carries significant business risk, as it allows an attacker to escalate privileges to a full administrative level. With a CVSS score of 7.2, the potential for unauthorized access to sensitive business data, store configurations, and user management functions makes this a high-priority security concern.

Immediate Action: Update to Vitepos version 3.6.0 or Vitepos Lite version 3.5.0 immediately to apply the necessary authorization constraints.

Proactive Monitoring: Audit user account modification logs for any unauthorized password reset activity initiated by users with the Outlet Manager role.

Compensating Controls: Implement administrative access restrictions and monitor for anomalous role-based activities using security plugins that track privilege changes.

Public Exploit Available: No (no confirmed public exploit available).

Immediate remediation is required to prevent unauthorized privilege escalation. Security teams should ensure the update is applied across all affected installations and conduct a review of user accounts to ensure no unauthorized administrative accounts were created while the vulnerability was present.