CVE-2025-22277: WordPress Vitepos plugin <= 3.1.4 - Broken Authentication vulnerability

Q: What is the severity of CVE-2025-22277?

CVE-2025-22277 has been classified as a critical vulnerability due to its potential for authentication bypass.

Q: How do I fix CVE-2025-22277?

To fix CVE-2025-22277, update Vitepos to version 3.1.5 or later.

Q: What versions of Vitepos are affected by CVE-2025-22277?

CVE-2025-22277 affects Vitepos versions from n/a to 3.1.4.

Q: Can CVE-2025-22277 lead to unauthorized access?

Yes, CVE-2025-22277 allows for authentication abuse which could lead to unauthorized access.

Q: Is the WordPress Vitepos plugin affected by CVE-2025-22277?

Yes, the WordPress Vitepos plugin version 3.1.4 and below are affected by CVE-2025-22277.

Published Apr 1, 2025

Updated

Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos allows Authentication Abuse. This issue affects Vitepos: from n/a through 3.1.4.

Other sources

Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.4.

— MITRE

Affected Software

2 affected components

Appsbd Vitepos<=3.1.4

Appsbd Vitepos Lite<=3.1.4

Remediation

Information

Update the WordPress Vitepos – Point of sale (POS) plugin for WooCommerce plugin to the latest available version (at least 3.1.5).

Event History

Apr 1, 2025

CVE Published

via MITRE·05:32 AM

Data Sourced

via MITRE·05:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-22277?