Vulnerability in Vitepos

CVE-2026-14237

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-res…

Affected products

  • Unknown Vitepos — versions 3.4.0, 0

References