myPOS Checkout WordPress plugin: PHP Object Injection
The myPOS Checkout WordPress plugin up to and including version 1.4.5 contains a PHP Object Injection vulnerability (CWE-502). An authenticated user with the shop manager role can submit crafted serialized data, which the plugin processes unsafely. This can let an attacker manipulate data and run harmful actions on the server, depending on the other plugins installed. Patchstack rates the CVSS score 7.2, while VulDB rates it 4.7.
myPOS · Checkout WordPress plugin
