Overview
A high-severity SQL injection vulnerability, tracked as CVE-2026-92766, has been disclosed in Vitepos – Point of Sale (POS) for WooCommerce, a plugin from developer appsbd that bridges physical retail checkout terminals with WooCommerce's order, inventory, and customer data. The flaw carries a CVSS 3.1 score of 7.5 and affects all versions through 3.5.1.
The vulnerability sits in the plugin's src_by request parameter, used across several REST API list endpoints — including /vitepos/v1/vendor/list — to filter and sort results. Because the parameter is concatenated into a dynamic SQL query without escaping or prepared-statement binding, an attacker can terminate the intended query early and append their own SQL.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-92766 |
| CVSS 3.1 Score | 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CWE | CWE-89 — SQL Injection |
| Attack Vector | Network |
| Authentication | None required (also exploitable by low-privilege vtpos-cashier roles) |
| Privileges Required | None |
| User Interaction | None |
| Affected Component | src_by parameter on REST list endpoints (e.g. /vitepos/v1/vendor/list) |
| Vulnerable Code | class-querybuilder.php (appsbd-lite core query builder) |
| Affected Versions | Vitepos / Vitepos Lite, all versions through 3.5.1 |
| Fixed Version | 3.6.0 — see note on an incomplete follow-up fix below |
| Assigner | Wordfence |
| Reserved / Published / Disclosed | 2026-09-16 / 2026-10-16 / 2026-10-15 |
How It Works
Vitepos exposes a family of REST list endpoints for its point-of-sale frontend — vendors, products, orders — that accept a src_by filter parameter to control sorting and filtering of results. The plugin's internal query builder takes the value supplied in src_by and interpolates it directly into the SQL query string rather than using parameterized bindings or an allowlist of safe operators.
Because these endpoints are reachable by unauthenticated users or by accounts holding only the low-privilege vtpos-cashier role (far below WordPress's administrator capability model), an attacker does not need meaningful access to the site to abuse the flaw. By crafting a src_by value that breaks out of the intended query clause, an attacker can append arbitrary SQL — enabling data extraction (confidentiality impact rated High) against the full WordPress/WooCommerce database, including customer and order records.
Impact Assessment
| Impact Area | Description |
|---|---|
| Confidentiality | High — full read access to the WordPress/WooCommerce database, including customer PII, order history, and stored credentials, is achievable |
| Integrity | None per the published CVSS vector, though blind SQLi primitives can sometimes be chained further depending on database permissions |
| Availability | None directly scored, though abusive queries can degrade database performance |
| Authentication Required | None — or trivial, low-privilege vtpos-cashier access |
| Automatable | Yes — REST endpoints with predictable parameters are straightforward to script against |
Who Is At Risk
- Any WooCommerce store running Vitepos / Vitepos Lite through version 3.5.1
- Retail and hospitality operators who rely on Vitepos's POS terminals for in-person checkout, where the vendor/product/order list endpoints back day-to-day register operations
- Stores that have issued low-privilege cashier accounts, since this flaw lowers the bar for exploitation even further than an unauthenticated path alone
Attack Chain
- Reconnaissance — Attacker identifies a WooCommerce store running Vitepos, either via asset fingerprinting or by locating the plugin's REST namespace.
- Unauthenticated (or low-privilege) request — Attacker sends a crafted request to a list endpoint such as
/vitepos/v1/vendor/listwith a malicioussrc_byvalue. - SQL injection — The unsanitized value reaches the query builder, allowing the attacker to append arbitrary SQL clauses.
- Data extraction — Customer records, order details, and other database contents are extracted for use in fraud, account takeover, or further compromise.
Mitigation
Immediate Actions
- Update Vitepos / Vitepos Lite to version 3.6.0 or later, which parameterizes and allowlists the
src_by[].valfilter operators that this flaw abuses. - Important: a follow-up vulnerability (CVE-2026-109414) found that the 3.6.0 fix only addressed the
gt/lt/le/gecomparison operators, leaving thebt(BETWEEN) operator branch still exploitable through version 3.6.1. Update to 3.6.2 or later to close both the original flaw and the incomplete-fix gap. - Review recent order, vendor, and product data for signs of unexpected access or export around the disclosure window.
Detection Opportunities
- Monitor web server and application logs for requests to
/vitepos/v1/vendor/list,/vitepos/v1/product/list, or/vitepos/v1/order/listcontaining SQL metacharacters (',--,UNION,SLEEP() in thesrc_byparameter. - Watch for a high volume of near-identical REST requests with incrementally varying payloads, a signature of automated blind-SQLi extraction.
Defence-in-Depth
- Restrict REST API access to Vitepos endpoints to trusted network ranges or authenticated sessions where your point-of-sale workflow allows it.
- Apply the principle of least privilege to
vtpos-cashierand other POS role assignments, and audit which accounts hold them. - Run the WordPress database user with minimum required privileges to limit the blast radius of any successful injection.
Background
Vitepos is a point-of-sale plugin built on top of WooCommerce, giving retail and hospitality businesses a register-style checkout interface, vendor management, and reporting layered over a standard WooCommerce store. It is maintained by developer appsbd. This is the second distinct SQL injection issue disclosed in the plugin within recent months — an earlier flaw (CVE-2026-14238) in a report endpoint, reported by researcher Real_King_Engine (ISAL FRAMEWORK), was also fixed in the 3.6.0 release.