CVE Intelligence
Analysis AI-assisted

CVE-2026-4880: Barcode Scanner (+Mobile App) up to 1.11.0 - Unauthenticated Privilege Escalation via Insecure Token Authentication

CVE-2026-4880 affects the Barcode Scanner (+Mobile App) WordPress plugin in versions up to and including 1.11.0. The record describes an unauthenticated flaw, classified as CWE-269, that can lead to administrator-level access, with a CVSS 3.1 base score of 9.8 assigned by Wordfence. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The Barcode Scanner (+Mobile App) plugin for WordPress, in versions up to and including 1.11.0, is affected by CVE-2026-4880, classified as CWE-269 (Improper Privilege Management). The record describes an unauthenticated flaw that can lead to administrator-level access.

Impact

According to the record, an unauthenticated attacker could gain full administrative access to the affected WordPress site. The Wordfence-assigned CVSS 3.1 base score is 9.8 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products and versions

  • Product: Ukrsolution Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale)
  • Affected range: ≤ 1.11.0
  • Fixed version: not listed in the record.

Exploitation status

The CISA KEV catalog does not list this CVE according to the record. The SSVC exploitation field is 'none', and the EPSS probability is 0.00778 (percentile 0.54694). No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Identify whether the plugin is installed on your WordPress sites and which version is in use.
  • The record lists no fixed version. Check the plugin developer and WordPress.org for an updated release and apply it as soon as it is confirmed.
  • Until a fixed version is confirmed, consider deactivating and removing the plugin if it is not essential to operations.
  • Review administrator accounts and recent changes to user roles and capabilities.

Detection guidance

  • Review user accounts for unexpected administrator roles or changes to capability settings.
  • Review web server and application logs for unusual activity involving the plugin.
  • Monitor for administrator accounts created outside normal provisioning processes.

Limitations of the available information

The record does not include a confirmed fixed version. It contains a WordPress.org changeset link, but does not state which plugin version that change corresponds to. No proof of exploitation is provided, and the number of affected installations is not stated.

Frequently asked questions

Does CVE-2026-4880 require authentication to exploit?

According to the record, the flaw is unauthenticated, and the CVSS vector lists privileges required as none (PR:N) and user interaction as none (UI:N).

Is there a fixed version of the Barcode Scanner plugin?

The record does not list a fixed version. Check the plugin developer and WordPress.org for an updated release, and treat the absence of a listed fix as unknown rather than as a confirmed lack of a fix.

Is this CVE known to be exploited in the wild?

The record indicates it is not listed in CISA KEV and that the SSVC exploitation field is none. No confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.