CVE-2026-4880

The Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) plugin for WordPress is vulnerable to privilege escalation via insecure token-based authentication in all versions up to, and including, 1.11.0. This is due to the plugin trusting a user-supplied Base64-encoded user ID in the token parameter to identify users, leaking valid authentication tokens through the 'barcodeScannerConfigs' action, and lacking meta-key restrictions on the 'setUserMeta' action. This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator by first spoofing the admin user ID to leak their authentication token, then using that token to update any user's 'wp_capabilities' meta to gain full administrative access.

• CWE-269

• https://plugins.trac.wordpress.org/browser/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/trunk/src/Core.php?rev=3391688#L498
• https://plugins.trac.wordpress.org/changeset/3506824/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders#file30
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a213e844-a0d3-4123-9f72-caef7702804c?source=cve

Published

Apr 16, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48792pam_usb provides hardware authentication for Linux using ord…4.4
• CVE-2026-48793Jellyfin is an open source self hosted media server. Prior t…8.8
• CVE-2026-48794Authelia is an open-source authentication and authorization …1.3
• CVE-2026-48795AdonisJS is a TypeScript-first web framework. From 10.1.3 un…8.6
• CVE-2026-48797Backpropagate is a Python library for fine-tuning large lang…9.3
• CVE-2026-48799Postiz is an AI social media scheduling tool. Prior to 2.21.…7.7
• CVE-2026-48800Notepad++ is a free and open-source source code editor. Prio…7.8
• CVE-2026-48801linkify-it is a links recognition library with full Unicode …7.5
• CVE-2026-48802python-engineio is a Python implementation of the Engine.IO …7.5
• CVE-2026-48804python-socketio is a Python implementation of the Socket.IO …7.5
• CVE-2026-48805Twig is a template language for PHP. Prior to 3.27.0, deprec…9.1
• CVE-2026-48806Twig is a template language for PHP. Prior to 3.27.0, ArrayE…9.1