The FooSales – Point of Sale plugin for WooCommerce is vulnerable because it fails to verify a user’s identity before permitting changes to user details such as email addresses. An authenticated attacker who holds Cashier-level or higher permissions can alter any user’s email, including that of an administrator. After changing the email, the attacker can initiate a password reset and gain full access to the compromised account. This flaw allows an attacker to take over accounts and elevate privileges, potentially leading to unauthorized system access, data theft, or further exploitation. The weakness corresponds to CWE‑269: Improper Privilege Management.

The vulnerability affects all installations of the FooSales plugin for WooCommerce up to and including version 1.43.0. No patch version is specified in the data, but the issue exists across the entire affected range.

With a CVSS score of 8.8, the flaw is considered high severity. EPSS availability is not reported, so the likelihood of exploitation cannot be precisely quantified at this time. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed public exploits. The attack vector requires an authenticated user with Cashier-level or higher rights; the attacker must send a request to the create_update_customer REST endpoint to change another user’s email. Given the broad reach of the role and the ability to reset passwords, the risk to sites running older versions of the plugin is significant.