CVE-2026-14237: Unknown Vitepos

High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days.

The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.

Affected products

• Unknown Vitepos: from 3.4.0, before 3.6.0 (fixed in 3.6.0); before 3.5.0 (fixed in 3.5.0)

Published 2026-08-10. Last modified 2026-08-26.