CyberRota Analysis
AI-GeneratedThe Vitepos WordPress plugin prior to version 3.6.0 contains a vulnerability that allows users with the Outlet Manager role to reset any user's password, including that of administrators, due to a lack of proper authorization checks in the password-reset API. This flaw could lead to unauthorized account access and potential takeover. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of account compromise.
Original NVD Description
The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.