CVE-2026-92766: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in appsbd Vitepos – Point of Sale (POS) for WooCommerce

CVE-2026-92766 describes an SQL Injection vulnerability in the Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress. The vulnerability arises from insufficient escaping and lack of proper query preparation of the 'src_by' parameter in the /vitepos/v1/vendor/list REST API endpoint. The permission callback for this route only requires assignment of any POS role, such as vtpos-cashier, allowing unauthenticated or low-privilege users to append malicious SQL queries. This can lead to unauthorized extraction of sensitive database information. The vulnerability affects all versions from 0 up to and including 3.5.1.

Successful exploitation allows attackers without authentication or with minimal POS role privileges to perform SQL Injection attacks, enabling them to extract sensitive information from the backend database. The vulnerability does not impact integrity or availability but has a high confidentiality impact. There are no known exploits in the wild at this time.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /vitepos/v1/vendor/list REST route to trusted users only and monitor for unusual activity related to POS roles. Avoid assigning POS roles to untrusted users.