FooSales: Privilege escalation via email change and account takeover
Summary
The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress does not properly verify a user's identity before updating account details such as the email address. All versions up to and including 1.43.0 are affected. An authenticated attacker with at least Cashier-level access can change the email address of any user, including administrators, then reset that user's password and take over the account.
Affected
- FooSales – Point of Sale (POS) for WooCommerce (WordPress plugin), all versions up to and including 1.43.0
Fixed in
- 1.43.1, according to WPScan (single third-party source, not yet confirmed by the vendor or Wordfence)
- Vendor advisory: Unknown.
Workaround
- Unknown. No vendor workaround found.
- Review Cashier accounts and revoke unnecessary access.
- Reset credentials of suspicious accounts.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC (ADP Vulnrichment): exploitation none, not automatable, total technical impact.
- No public proof of concept found at the time of research.
Our recommendation
- Check whether FooSales is installed on any WooCommerce site and which version is in use.
- Update to the latest available version after confirming the fix against the Wordfence record. A related FooSales flaw (CVE-2026-93548) is fixed in 1.43.3, so 1.43.3 is the practical target.
- Review administrator and cashier accounts and email addresses for unexpected changes, and check recent password resets.
- Enforce MFA on administrator accounts where possible and limit who holds Cashier roles.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- WordPress trac changeset class-foosales-rest-api.php plugins.trac.wordpress.org
- WordPress trac changeset foosales-xmlrpc-functions.php plugins.trac.wordpress.org
- WPScan plugin page FooSales wpscan.com
- OpenCVE CVE-2026-77183 app.opencve.io
- Red Packet Security CVE alert www.redpacketsecurity.com
- Strix CVE-2026-77183 www.strix.ai
- VulDB 415733 (related FooSales flaw) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:46.
Original description (NVD)
The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with FooSales Cashier-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
NVD references (3)
- https://plugins.trac.wordpress.org/changeset/3719657/foosales/trunk/admin/class-foosales-rest-api.php
- https://plugins.trac.wordpress.org/changeset/3719657/foosales/trunk/admin/foosales-xmlrpc-functions.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/97097d41-1d78-4db0-8ee2-70a776bd99f2?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.