CVE-2026-77183

{
  "etk_id": "ETK-2026-1137",
  "cve_id": "CVE-2026-77183",
  "display_id": "CVE-2026-77183",
  "ghsa_id": "GHSA-mqr2-vf6c-h2jp",
  "euvd_id": "EUVD-2026-96102",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Account takeover in FooSales POS for WooCommerce",
  "summary": "FooSales POS for WooCommerce versions through 1.43.0 inadequately verify identity during account-detail updates. An authenticated user with FooSales Cashier access or greater could change another user's email address and potentially take over that account, including an administrator account, through password recovery.",
  "mitigation": "Restrict FooSales Cashier and higher roles to trusted users, and monitor or review account email-address changes. Update the plugin promptly when a vendor-fixed release becomes available.",
  "vendor": "foosales",
  "product": "FooSales – Point of Sale (POS) for WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.43.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "FooSales – Point of Sale (POS) for WooCommerce",
      "purl": null
    }
  ],
  "cwes": [
    269
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0029,
  "epss_percentile": 0.2025,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 42.80382358333333,
  "t0_at": "2026-10-10T05:31:01.973000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-10T09:47:01.981368+00:00",
      "days": 0.17777787462962963,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T05:31:01.973000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-10T05:31:01.973000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T05:31:01.973000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77183"
    }
  }
}