What’s Vulnerable › Vulnerabilities
CVE-2026-8157: Vitepos < 3.4.2 - Outlet Manager+ Privilege Escalation
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-22 · updated 2026-06-22
- Weakness: CWE-269
Description
The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.
Affected products
- Vitepos: before 3.4.2 — fixed in 3.4.2
How to fix
Upgrade to a fixed version: Vitepos 3.4.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-8157 or the next vulnerability affects your stack