CVE-2026-77183 foosales CVE debrief

Who should care

Defenders responsible for WordPress installations with the FooSales – Point of Sale (POS) for WooCommerce plugin should assess exposure and verify the integrity of user accounts and email validation processes.

Why it matters

The FooSales – Point of Sale (POS) for WooCommerce plugin vulnerability allows authenticated attackers to escalate privileges via account takeover, impacting WordPress installations with the plugin installed.

• Authenticated attackers with FooSales Cashier-level access and above can change arbitrary user's email addresses, including administrators.
• Attackers can leverage changed email addresses to reset user passwords and gain access to their accounts.
• Defenders need to verify exposure of affected versions and assess the integrity of user accounts and email validation processes.
• Remediation priority is high due to the potential for account takeover and privilege escalation.

Technical summary

The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. An attacker with FooSales Cashier-level access can change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. Defenders should prioritize verifying exposure of FooSales – Point of Sale (POS) for WooCommerce versions up to 1.43.0 and assess the integrity of user accounts and email validation processes.

Defensive priority

Defenders should prioritize verifying exposure of FooSales – Point of Sale (POS) for WooCommerce versions up to 1.43.0 and assess the integrity of user accounts and email validation processes.

Recommended defensive actions

• Verify exposure of FooSales – Point of Sale (POS) for WooCommerce versions up to 1.43.0
• Assess the integrity of user accounts and email validation processes
• Restrict access to sensitive areas of the plugin
• Monitor for suspicious activity related to user account changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. The source item and supplemental sources offer additional context about the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.