CVE-2026-92766 appsbd CVE debrief

Who should care

Defenders responsible for WordPress installations with the Vitepos – Point of Sale (POS) for WooCommerce plugin version 3.5.1 or earlier should assess exposure and prioritize verification of this vulnerability. This includes roles responsible for plugin updates, vulnerability management, and database security.

Why it matters

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to SQL injection, allowing unauthenticated attackers to potentially extract sensitive information from the database. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations, particularly for unauthenticated attackers and those with POS roles.

• Unauthenticated attackers can potentially extract sensitive information from the database.
• Attackers with POS roles (such as vtpos-cashier) can also exploit the vulnerability.
• Successful exploitation may lead to information disclosure.
• Verification of affected versions and exposure is necessary.

Technical summary

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Unauthenticated attackers can exploit this vulnerability to append additional SQL queries into already existing queries, potentially leading to sensitive information extraction from the database.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assessing exposure, particularly for unauthenticated attackers and those with POS roles.

Recommended defensive actions

• Verify the presence of the Vitepos – Point of Sale (POS) for WooCommerce plugin version 3.5.1 or earlier in your WordPress installations.
• Assess exposure to the 'src_by' parameter in the /vitepos/v1/vendor/list REST route.
• Restrict access to the /vitepos/v1/vendor/list REST route to only necessary roles.
• Implement additional monitoring for potential SQL injection attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by insufficient escaping on the user-supplied 'src_by' parameter and a lack of sufficient preparation on the existing SQL query in the Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress. This allows unauthenticated attackers to append additional SQL queries into already existing queries, potentially leading to sensitive information extraction from the database.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.