A WordPress plugin designed for inventory and order management accepts a Base64‑encoded user identifier as part of a token. The plugin trusts this value without validation and exposes the current authentication token through a public endpoint. Because of these flaws, any visitor can forge the admin user’s identifier, obtain the token, and then use that token to call an otherwise restricted action that writes to the user meta table. This sequence enables an unauthenticated attacker to change the wp_capabilities meta field for any user, effectively gaining full administrative privileges within the WordPress installation.

The vulnerability exists in the Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS plugin for WordPress versions up to and including 1.11.0. Users running any of these releases on a WordPress site are potentially affected.

The common vulnerability scoring system assigns a 9.8 score, categorizing this as critical. Exploitation requires no special credentials and is performed via simple HTTP requests, so the attack vector is likely remote unauthenticated. While the EPSS score is not available, the lack of any authentication barrier and the public nature of the token leakage make exploitation highly likely, and the issue is not listed in the CISA KEV catalog at this time.