This vulnerability resides in the Oliver POS – A WooCommerce Point of Sale plugin for WordPress and allows an attacker to bypass the REST API authentication mechanism by sending a crafted HTTP header. The plugin’s authorization callback compares the value of the attacker‑supplied 'OliverAuth' header to the stored 'oliver_pos_authorization_token' option using PHP’s loose comparison operator. On a fresh install where the option is unset, the comparison '0' == false evaluates to true, allowing an unauthenticated user to obtain full access to all POS API endpoints. With this access, an attacker can read, modify, or delete user data, including administrator accounts, and can potentially reset an admin email to seize control of the site.

All installations of Oliver POS version 2.4.2.6 or earlier on WordPress sites are affected. The vulnerability exists in the '/wp-json/pos-bridge/*' REST API namespace served by the plugin, and impacts any site that has installed a vulnerable version of the plugin.

The CVSS score of 6.5 classifies the issue as medium severity, and no EPSS value is publicly available. The vulnerability is not listed in the CISA KeV catalog. The likely attack vector is a simple HTTP request to any REST endpoint with the header 'OliverAuth: 0', which requires no authentication or user interaction beyond the plugin being installed. Successful exploitation would grant the attacker the same privileges as a fully authenticated user, potentially leading to data breach or complete site takeover.