CVE-2026-8157: Vitepos < 3.4.2 - Outlet Manager+ Privilege Escalation
The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vitepos WordPress pluginto a version that resolves this vulnerability.Fixed in 3.4.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8157?
The severity of CVE-2026-8157 is rated at 76, indicating a significant risk for privilege escalation.
How do I fix CVE-2026-8157?
To fix CVE-2026-8157, upgrade the Vitepos WordPress plugin to version 3.4.2 or later.
What kind of vulnerability is CVE-2026-8157?
CVE-2026-8157 is a privilege escalation vulnerability affecting the Vitepos WordPress plugin.
Who is affected by CVE-2026-8157?
Authenticated users with custom roles on Vitepos WordPress plugin versions below 3.4.2 are affected by CVE-2026-8157.
What is the impact of CVE-2026-8157?
The impact of CVE-2026-8157 includes allowing unauthorized users to escalate their privileges to administrator levels.