The Vitepos – Point of Sale (POS) for WooCommerce plugin is vulnerable to generic SQL injection via the 'src_by' parameter. Because the input is insufficiently escaped and the existing SQL query is not properly prepared, attackers can append arbitrary SQL statements. This flaw can be leveraged by unauthenticated users or any authenticated user with a POS role, such as a cashier, to read sensitive database content.

The vulnerability affects the Vitepos – Point of Sale (POS) for WooCommerce plugin, all releases up to and including version 3.5.1. WordPress sites running any of these plugin versions are at risk.

The CVSS score of 7.5 indicates a high severity level. The EPSS score is not available, suggesting limited publicly known exploitation data; however, the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a request to the /vitepos/v1/vendor/list REST route where the permission callback only requires any POS role assignment. An unauthenticated or low‑privilege user can therefore inject SQL to retrieve confidential information from the database.