CVE-2026-48809.8CriticalCWE-269

CVE-2026-4880: Barcode Scanner (+Mobile App) <= 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication

ukrsolution · Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, PO…

Affected: ukrsolution Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, PO… · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.5%probability of exploitation in the next 30 days

44th percentile

050100

Higher than 44% of scored CVEs

9.8CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

The Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) plugin for WordPress is vulnerable to privilege escalation via insecure token-based authentication in all versions up to, and including, 1.11.0. This is due to the plugin trusting a user-supplied Base64-encoded user ID in the token parameter to identify users, leaking valid authentication tokens through the 'barcodeScannerConfigs' action, and lacking meta-key restrictions on the 'setUserMeta' action. This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator by first spoofing the admin user ID to leak their authentication token, then using that token to update any user's 'wp_capabilities' meta to gain full administrative access.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

ukrsolution · Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)up to and including 1.11.0

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Privilege Management · Access Control
Vendor: ukrsolution
Published: April 2026
Band: Unlikely (under 1%), April 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-4880 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.