Barcode Scanner with Inventory & Order Manager < 1.5.4 - Unauthenticated Privilege Escalation

Description

The Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader. plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.3. This is due to the plugin not properly restricting user meta values that can be updated. This makes it possible for unauthenticated attackers to elevate their privileges to an administrator.