WordPress Plugin Vulnerabilities

POS Entegratör – Gurmehub Ödeme Eklentisi < 3.8.0 - Missing Authorization

Description

The POS Entegratör – Gurmehub Ödeme Eklentisi plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.7.103. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
pos-entegrator
Fixed in 3.8.0

References

CVE
CVE-2026-57688
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5b7b3286-b36d-42c6-94e8-e8c24047c472

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
hivesec
Verified
No
WPVDB ID
58c0c4bb-1435-41d1-9037-caa6c6b8d2b1

Timeline

Publicly Published
2026-06-29 (about 28 days ago)
Added
2026-07-07 (about 19 days ago)
Last Updated
2026-07-07 (about 19 days ago)

Other

Published
Title
Published
2023-10-12
Title
wpDiscuz < 7.6.12 - Missing Authorization in AJAX Actions
Published
2022-11-08
Title
Blog2Social < 6.9.12 - Subscriber+ Settings Update
Published
2025-01-07
Title
WordPress Webinar Plugin – WebinarPress < 1.33.25 - Missing Authorization to Authenticated (Subscriber+) Webinar Updates
Published
2026-02-09
Title
KuteShop <= 4.2.9 - Missing Authorization
Published
2025-04-07
Title
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update