CVE-2026-14237CWE-269privilege-escalation

CVE-2026-14237

High · published August 10, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-08-10T11:16Z
References (1)
https://wpscan.com/vulnerability/7f1eb6ec-c4fb-4c0d-887d-1812a84e29c0/ · [email protected]
EPSS history
Timeline
  • 10 AUG 06:00Z
    Vitepos < 3.6.0 - Outlet Manager+ Privilege Escalation
    cvelistv5