CVE-2026-92766 | appsbd Vitepos Plugin up to 3.5.1 on WordPress Permission Callback /vitepos/v1/vendor/list src_by sql injection

October 16, 2026 Yanac

A vulnerability was found in appsbd Vitepos Plugin up to 3.5.1 on WordPress. It has been declared as critical. Affected by this issue is some unknown functionality of the file /vitepos/v1/vendor/list of the component Permission Callback. The manipulation of the argument src_by results in sql injection.

This vulnerability is cataloged as CVE-2026-92766. The attack may be launched remotely. There is no exploit available.VulDB Recent EntriesRead More