Critical WordPress Plugin Flaw Grants Admin Privileges

The National Vulnerability Database (NVD) has issued a critical advisory for CVE-2026-4880, impacting the Barcode Scanner (+Mobile App) plugin for WordPress. This nasty vulnerability, present in all versions up to and including 1.11.0, allows unauthenticated attackers to escalate their privileges to full administrator access. Yeah, you heard that right – full admin.

The root cause lies in insecure token-based authentication. The plugin, designed for inventory management, order fulfillment, and POS systems, apparently trusts a user-supplied Base64-encoded user ID within its ‘token’ parameter. Compounding this, valid authentication tokens are leaked via the ‘barcodeScannerConfigs’ action, and there’s a serious lack of meta-key restrictions on the ‘setUserMeta’ action. This trifecta of poor security hygiene means an attacker can spoof an admin user ID, snag their authentication token, and then use it to update any user’s ‘wp_capabilities’ meta to seize complete control. It’s a textbook privilege escalation scenario, and frankly, it’s a bit of a facepalm moment for a plugin handling critical business functions.