Privilege escalation in Ukrsolution Barcode Scanner (+mobile App) – Inventory Manager, Order Fulfillment System, Pos (Point Of Sale)
CVE-2026-4880
The Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) plugin for WordPress is vulnerable to privilege escalation via insecure token-based authentication in all versions up to, and including, 1.11.0. This is due to the plugin trusting a user-supplied Base64-encoded user ID in the token parameter to identify users, leaking valid authentication tokens through the 'barcodeScannerConfigs' action, and lacking meta-key restrictions on the 'setUserMeta' action. This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator by first spoofing the admin user ID to leak their authentication token, then using that token to update any user's 'wp_capabilities' meta to gain full administrative access.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (54.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 54.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.008 · change: +0.003
Affected products
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-4880?
- CVE-2026-4880 is a critical-severity vulnerability in Ukrsolution Barcode Scanner (+mobile App) – Inventory Manager, Order Fulfillment System, Pos (Point Of Sale), classified under Improper Privilege Management. CVSS score: 9.8/10. Published 2026-04-16.
- How severe is CVE-2026-4880?
- Critical severity. CVSS v3 base score is 9.8 out of 10.