MWB Point of Sale (POS) for WooCommerce <= 1.0.0 - Missing Authorization

The MWB Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.0.0. This is due to missing nonce validation and capability checks on several AJAX actions found within the plugin . This makes it possible for authenticated attackers, with low-level privileges, such as subscriber, to execute otherwise restricted AJAX calls and modify the plugin's settings.