Barcode Scanner WordPress Plugin Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Barcode Scanner WordPress plugin, specifically in versions through 1.11.0. The issue arises from insecure token-based authentication, where the plugin improperly trusts user-supplied Base64-encoded user IDs in the token parameter. This flaw allows unauthenticated attackers to spoof admin user IDs, leak valid authentication tokens, and then use those tokens to gain administrative privileges by modifying user capabilities.

Impact

Exploitation of this vulnerability allows unauthenticated users to gain administrative privileges on the WordPress site.

Remediation

Users are advised to update the Barcode Scanner WordPress plugin to version 1.12.0 or later.