CVE-2026-77183

Name of the Vulnerable Software and Affected Versions FooSales – Point of Sale (POS) for WooCommerce versions prior to 1.43.1

Description This issue allows privilege escalation via account takeover. The plugin fails to properly validate a user's identity before updating account details, such as the email address. Authenticated attackers with FooSales Cashier-level access or higher can change the email addresses of arbitrary users, including administrators, and subsequently reset those passwords to gain full account access.

Recommendations Update FooSales – Point of Sale (POS) for WooCommerce to version 1.43.1 or later.