CVE-2024-0702 affects the Oliver POS WooCommerce Point of Sale plugin for WordPress, where missing capability checks on AJAX functions in includes/class-pos-bridge-install.php allow authenticated users with minimal privileges (subscriber-level and above) to execute unauthorized actions. These actions include deactivating the plugin, disconnecting subscriptions, and syncing status. The vulnerability is categorized under CWE-862 (Missing Authorization) and has a CVSS 3.1 base score of 7.3, reflecting a high severity due to network attack vector, low attack complexity, and impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor, and no exploits are known in the wild.

An attacker with subscriber-level or higher access can perform unauthorized administrative actions on the Oliver POS plugin, potentially disrupting point of sale operations by deactivating the plugin or disconnecting subscriptions. This could lead to loss of service availability and integrity of the POS system. Confidentiality impact is limited but present due to unauthorized access to certain plugin functions. The overall impact is rated high based on the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and monitor for suspicious activity related to the plugin. Avoid granting subscriber or higher privileges to untrusted users. Do not rely on the plugin's current authorization checks for security.