The Vitepos – Point of Sale plugin for WordPress contains a blind SQL injection flaw in the handling of the 'src_by[].val' parameter when the 'bt' (BETWEEN) operator is used. Because user input is not properly escaped or bound, an attacker can append arbitrary SQL fragments to existing queries, enabling retrieval of sensitive database contents. The weakness is a classic instance of CWE‑89 and can result in unauthorized disclosure of customer or transaction data.

All releases of the Vitepos plugin up to and including version 3.6.1 are affected. The vulnerability exists in API endpoints that process the 'src_by' query parameters and applies to sites running this WordPress plugin with a compromised or trusted administrator account that has vendor‑level or higher access.

The CVSS score of 6.5 indicates a medium severity assessment, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker must have authenticated vendor‑level access or higher to exploit this flaw; once that condition is met, exploitation is straightforward and does not require additional preconditions or external services.