CVE-2024-13513

The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2.3 via the logging functionality. This makes it possible for unauthenticated attackers to extract sensitive data including the plugin's clientToken, which in turn can be used to change user account information including emails and account type. This allows attackers to then change account passwords resulting in a complete site takeover. Version 2.4.2.3 disabled logging but left sites with existing log files vulnerable.

• CWE-862

• https://plugins.trac.wordpress.org/browser/oliver-pos/trunk/includes/models/class-pos-bridge-user.php#L373Product
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3234731%40oliver-pos%2Ftrunk&old=3056051%40oliver-pos%2Ftrunk&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bf6b7d8d-fb13-4eb4-b0b4-d0a10ad2a21e?source=cveThird Party Advisory

Published

Feb 15, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-13508The Booking Package plugin for WordPress is vulnerable to Re…6.1
• CVE-2024-13509The WS Form LITE and PRO plugins for WordPress are vulnerabl…6.1
• CVE-2024-1351Under certain configurations of --tlsCAFile and tls.CAFile, …9.8
• CVE-2024-13510The ShopSite plugin for WordPress is vulnerable to Cross-Sit…6.1
• CVE-2024-13511The Variation Swatches for WooCommerce plugin, in all versio…4.3
• CVE-2024-13512The Wonder FontAwesome plugin for WordPress is vulnerable to…5.4
• CVE-2024-13514The B Slider- Gutenberg Slider Block for WP plugin for WordP…4.3
• CVE-2024-13515The Image Source Control Lite – Show Image Credits and Capti…6.1
• CVE-2024-13516The Kubio AI Page Builder plugin for WordPress is vulnerable…6.1
• CVE-2024-13517The Easy Digital Downloads – eCommerce Payments and Subscrip…4
• CVE-2024-13518The Simple:Press Forum plugin for WordPress is vulnerable to…4.3
• CVE-2024-13519The MarketKing — Ultimate WooCommerce Multivendor Marketplac…4.4