CVE-2024-13513
Published: 15 February 2025
Description
The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2.3 via the logging functionality. This makes it possible for unauthenticated attackers to extract sensitive data including the plugin's clientToken, which in turn can be used to change user account information including emails and account type. This allows attackers to then change account passwords resulting in a complete site takeover. Version 2.4.2.3 disabled logging but left sites with existing log files vulnerable.
Security Summary
CVE-2024-13513 is a sensitive information exposure vulnerability in the Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress, affecting all versions up to and including 2.4.2.3. The flaw arises from the plugin's logging functionality, which exposes sensitive data such as the plugin's clientToken.
Unauthenticated attackers can exploit this vulnerability by accessing the log files to extract the clientToken. Armed with this token, attackers can modify user account information, including emails and account types, and then change account passwords, enabling complete site takeover. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is linked to CWE-862.
Version 2.4.2.3 of the plugin disables logging as a mitigation measure, though sites retaining existing log files remain exposed. Additional details are available in the Wordfence threat intelligence report and the plugin's code repository changes on the WordPress Trac, including the relevant code location in class-pos-bridge-user.php and changeset updates.
Details
- CWE(s)