WordPress Plugin Vulnerabilities

Barcode Scanner with Inventory & Order Manager < 1.10.5 - Authenticated (Shop Manager+) Directory Traversal

Description

The Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.10.4. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to perform actions on files outside of the originally intended directory.

Affects Plugins

Plugin icon
barcode-scanner-lite-pos-to-manage-products-inventory-and-orders
Fixed in 1.10.5

References

CVE
CVE-2025-58972
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/eb3a26c7-8693-4a1d-a2b9-c548ef3c0ee0

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
2.7 (low)

Miscellaneous

Original Researcher
ChuongVN
Verified
No
WPVDB ID
fcc12572-f259-4983-9054-63b883a1439d

Timeline

Publicly Published
2025-10-15 (about 11 months ago)
Added
2025-10-29 (about 10 months ago)
Last Updated
2025-10-29 (about 10 months ago)

Other

Published
Title
Published
2026-06-09
Title
Mac Photo Gallery <= 3.0 - Unauthenticated Arbitrary File Deletion
Published
2026-05-16
Title
Backup and Restore plugin – WordPress <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Deletion
Published
2025-07-30
Title
HT Mega – Absolute Addons For Elementor < 2.9.2 - Authenticated (Author+) Path Traversal to Limited Arbitrary CSS File Actions
Published
2025-07-15
Title
Counter live visitors for WooCommerce < 1.3.7 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block
Published
2026-04-01
Title
MW WP Form < 5.1.1 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir