CVE-2024-2661

The Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader. plugin for WordPress is vulnerable to blind SQL Injection via the ‘currentIds’ parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

• CWE-89

• https://plugins.trac.wordpress.org/browser/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/trunk/src/Core.php#L621
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3074826%40barcode-scanner-lite-pos-to-manage-products-inventory-and-orders%2Ftrunk&old=3048878%40barcode-scanner-lite-pos-to-manage-products-inventory-and-orders%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3c8ba503-db7e-4ac1-898f-a301854db60f?source=cve
• https://plugins.trac.wordpress.org/browser/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/trunk/src/Core.php#L621
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3074826%40barcode-scanner-lite-pos-to-manage-products-inventory-and-orders%2Ftrunk&old=3048878%40barcode-scanner-lite-pos-to-manage-products-inventory-and-orders%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3c8ba503-db7e-4ac1-898f-a301854db60f?source=cve

Published

May 2, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26604In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26605In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26606In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26607In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2024-26608In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-26609Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-26610In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-26611In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26612In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-26613Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-26614In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-26615In the Linux kernel, the following vulnerability has been re…5.5