CVE-2026-77183

Summary

The FooSales POS plugin allows authenticated users with cashier-level access or higher to change any user's email address, including administrators. This privilege escalation flaw enables attackers to reset passwords and fully compromise target accounts.

Exploitability

Exploitation requires an authenticated attacker with cashier-level access or higher, making it moderately difficult but achievable through social engineering or compromised credentials.

Blast radius

The vulnerability could allow attackers to gain administrative access across multiple user accounts, potentially leading to complete system compromise and data exfiltration.

Detection

Monitor for unusual email address update requests in WordPress user management logs, particularly when updates are made by users with cashier-level permissions or higher.

Prioritized remediation

Upgrade to version 1.43.1 or later to address the privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.