CVE-2026-92766: Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This makes it possible for unauthenticated attackers, or authenticated attackers holding any POS role (such as vtpos-cashier), to exploit the vulnerability, as the /vitepos/v1/vendor/list REST route's permission callback requires only a POS role assignment rather than any elevated WordPress capability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated remote attackers can exploit it. Attackers authenticated with any POS role, including vtpos-cashier, can also exploit it because the affected REST route does not require an elevated WordPress capability.
What access or interaction is required?
No authentication, privileges, or user interaction are required for unauthenticated exploitation. The vulnerable input is the src_by parameter on the /vitepos/v1/vendor/list REST route.
What could an attacker obtain?
An attacker can append SQL to existing queries and use the injection to extract sensitive information from the WordPress database.
Which versions are affected?
All Vitepos versions through 3.5.1, including 3.5.1, are affected according to the provided information.