CVE-2026-4880 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: April 16, 2026
Barcode Scanner (+Mobile App) - Privilege Escalation
Published: April 16, 2026Updated: April 16, 2026Remote Exploitable
Overview
Barcode Scanner (+Mobile App) WordPress plugin <= 1.11.0 contains a privilege escalation caused by insecure token-based authentication trusting user-supplied Base64 user ID and lacking meta-key restrictions, letting unauthenticated attackers escalate to admin by spoofing tokens.
Severity & Score
Severity: Critical
CVSS Score: 9.8
Impact
Unauthenticated attackers can escalate privileges to administrator, gaining full control over the WordPress site.
Mitigation
Update to the latest version beyond 1.11.0 where this issue is fixed.
References
- https://plugins.trac.wordpress.org/browser/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/trunk/src/Core.php?rev=3391688#L498
- https://plugins.trac.wordpress.org/changeset/3506824/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders#file30
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a213e844-a0d3-4123-9f72-caef7702804c?source=cve
Related Resources
Details
- CVE ID
- CVE-2026-4880
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- broken_access_control
- Status
- new
CWE
- CWE-269
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H