WooCommerce POS Plugin Allows Email Change Without Verification

The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with FooSales Cashier-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The FooSales Point of Sale plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to 1.43.0. By failing to properly validate user identity before allowing email address changes, the plugin enables authenticated attackers with Cashier-level access or higher to modify email addresses of any user—including administrators. This is particularly dangerous in e-commerce environments where POS systems are integrated with WordPress user management. Once an attacker changes an admin's email, they can leverage password reset functionality to gain full administrative control, effectively taking over the entire WordPress installation and any associated WooCommerce store operations.

Casky's 224 matched skills use Claude AI with extended reasoning to detect the privilege escalation patterns underlying this vulnerability, specifically mapping to MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would identify findings around improper access control enforcement, detection of email modification requests lacking identity confirmation checks, and evidence of lateral privilege escalation attempts from low-privileged accounts (Cashier role) to high-privileged ones (Administrator). The platform would flag suspicious account modification patterns in WooCommerce logs, unauthorized email changes correlated with subsequent password reset activities, and role-based access control bypasses—enabling security teams to catch account takeover attempts in real-time before administrative compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-77183.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-77183

Casky has 224 skills that investigate the attack patterns behind CVE-2026-77183. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn