CVE-2024-0702 Overview
CVE-2024-0702 affects the Oliver POS WooCommerce Point of Sale plugin for WordPress in all versions up to and including 2.4.2.1. The vulnerability stems from missing capability checks on several functions hooked via AJAX in the includes/class-pos-bridge-install.php file. Authenticated attackers with subscriber-level access or higher can invoke privileged actions such as deactivating the plugin, disconnecting the subscription, and syncing status data. The flaw is categorized as a Missing Authorization issue ([CWE-862]).
Critical Impact
Any authenticated WordPress user, including low-privilege subscribers, can disrupt Oliver POS operations and tamper with subscription state on affected sites.
Affected Products
- Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress
- All versions through 2.4.2.1
- WordPress sites running the oliverpos:oliver_pos plugin component
Discovery Timeline
- 2024-02-29 - CVE-2024-0702 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0702
Vulnerability Analysis
The Oliver POS plugin registers multiple AJAX endpoints through WordPress's wp_ajax_ action hook system. These endpoints execute privileged operations including plugin deactivation, subscription disconnection, and status synchronization. The handlers in includes/class-pos-bridge-install.php do not verify the caller's WordPress capabilities before performing these actions.
WordPress treats any logged-in user as eligible to invoke wp_ajax_ actions unless the handler enforces capability or nonce checks. Because Oliver POS omits both current_user_can() checks and adequate nonce verification on the affected functions, the plugin trusts the authenticated session implicitly. The vulnerability falls under Broken Access Control and Missing Authorization patterns common to plugin-level WordPress flaws.
Root Cause
The root cause is the absence of authorization checks in AJAX callback functions defined in class-pos-bridge-install.php. The plugin author registered administrative operations as AJAX endpoints accessible to any authenticated session, without restricting them to administrators or shop managers. See the WordPress Plugin Code Review for the affected source.
Attack Vector
An attacker first obtains subscriber-level access, which WordPress sites with open registration grant automatically. The attacker then sends a crafted POST request to /wp-admin/admin-ajax.php referencing one of the vulnerable Oliver POS actions. The handler executes without checking the caller's role, allowing the attacker to deactivate the plugin, sever the Oliver POS subscription link, or modify connection status. Refer to the Wordfence Vulnerability Report for additional analysis.
Detection Methods for CVE-2024-0702
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php containing Oliver POS action names from low-privilege user sessions
- Sudden plugin deactivation events for oliver-pos recorded in the WordPress activity log
- Unexplained disconnection of the Oliver POS subscription or sync status changes in the merchant dashboard
- New subscriber accounts created shortly before suspicious AJAX activity
Detection Strategies
- Review web server access logs for admin-ajax.php requests with Oliver POS action parameters originating from non-administrator users
- Compare the installed plugin version against 2.4.2.1 and flag any site at or below this version
- Correlate WordPress audit logs with HTTP request logs to identify privilege-action mismatches
Monitoring Recommendations
- Enable a WordPress activity logging plugin to capture plugin state changes and user role context
- Forward admin-ajax.php request logs to a centralized SIEM for behavioral baselining
- Alert on plugin deactivation events that do not originate from administrator accounts
How to Mitigate CVE-2024-0702
Immediate Actions Required
- Update the Oliver POS plugin to a version later than 2.4.2.1 once the vendor publishes a fixed release
- Audit existing WordPress user accounts and remove unused subscriber accounts
- Disable open user registration on sites that do not require it by unchecking Settings → General → Membership
- Review recent plugin state changes and restore the Oliver POS connection if tampering is detected
Patch Information
A code change addressing the missing capability checks is referenced in the WordPress Changeset History. Site administrators should confirm they are running the patched build by reviewing the plugin version in the WordPress admin dashboard and consulting vendor release notes.
Workarounds
- Temporarily deactivate the Oliver POS plugin if patching cannot be performed immediately
- Restrict access to /wp-admin/admin-ajax.php at the web application firewall by blocking requests referencing vulnerable Oliver POS actions from non-administrator sessions
- Enforce strong authentication on all WordPress accounts to limit the pool of attackers who can reach the authenticated attack surface
# Example WAF rule to block Oliver POS AJAX actions from unauthenticated or low-privilege contexts
# Adjust action names to match the vulnerable handlers in class-pos-bridge-install.php
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" \
"chain,deny,status:403,id:1002024,msg:'Block Oliver POS privileged AJAX action'"
SecRule ARGS:action "@rx ^(pos_bridge_deactivate|pos_bridge_disconnect|pos_bridge_sync_status)$"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
