CVE-2026-4880 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: April 16, 2026
Barcode Scanner (+Mobile App) - Privilege Escalation
Overview
Barcode Scanner (+Mobile App) WordPress plugin <= 1.11.0 contains a privilege escalation caused by insecure token-based authentication trusting user-supplied Base64 user ID and lacking meta-key restrictions, letting unauthenticated attackers escalate to admin by spoofing tokens.
Severity & Score
Impact
Unauthenticated attackers can escalate privileges to administrator, gaining full control over the WordPress site.
Mitigation
Update to the latest version beyond 1.11.0 where this issue is fixed.
References
- https://plugins.trac.wordpress.org/browser/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders/trunk/src/Core.php?rev=3391688#L498
- https://plugins.trac.wordpress.org/changeset/3506824/barcode-scanner-lite-pos-to-manage-products-inventory-and-orders#file30
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a213e844-a0d3-4123-9f72-caef7702804c?source=cve
Social Media Activity(2 posts)
š“ CVE-2026-4880 - Critical (9.8) The Barcode Scanner (+Mobile App) ā Inventory manager, Order fulfillment system, POS (Point of Sale) plugin for WordPress is vulnerable to privilege escalation via insecure token-based authentication in all versions up to, and including, 1.11.0.... š https://www.thehackerwire.com/vulnerability/CVE-2026-4880/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original post
šØ CVE-2026-4880 (CRITICAL, CVSS 9.8): ukrsolution Barcode Scanner (+Mobile App) plugin for WordPress lets unauthenticated attackers gain admin access via insecure Base64 token handling. Remove or disable plugin until patched. https://radar.offseq.com/threat/cve-2026-4880-cwe-269-improper-privilege-managemen-a28ccef6 #OffSeq #WordPress #CVE2026_4880
View original postRelated Resources
Details
- CVE ID
- CVE-2026-4880
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- broken_access_control
- Status
- new
- EPSS
- 11.9%
- Social Posts
- 2
CWE
- CWE-269
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H