The Oliver POS plugin protects its /wp-json/pos-bridge/* REST API namespace using a permission callback that compares the 'OliverAuth' header against a stored authorization token using a loose PHP equality check (==). On fresh installations where the authorization token is unset (returns false), the comparison '0' == false evaluates to true, enabling an attacker to bypass authentication by sending 'OliverAuth: 0'. This bypass grants full access to all POS API endpoints, allowing unauthorized reading of user data, updating user profiles, and deleting non-admin users. The vulnerability is tracked as CVE-2026-6072 with a CVSS 3.1 base score of 6.5 (medium severity). No patch or official remediation has been published as of the data provided.

Successful exploitation grants unauthenticated attackers full access to the POS REST API endpoints. Attackers can read sensitive user information including administrator details, modify user profiles such as email addresses, and delete non-administrative users. This can lead to a complete site takeover if an administrator's email is reset via the compromised API. The vulnerability compromises confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid fresh installations without completing the connection flow that sets the authorization token. Monitoring for unusual API access and restricting access to the POS API endpoints by network controls may reduce exposure. Do not rely on the current authorization mechanism as it is vulnerable to bypass.