Directory Traversal Risk in WCPOS Plugin for WooCommerce by WordPress
CVE-2026-16078

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Wcpos – Point Of Sale (pos) Plugin For WooCommerce
Vendor
CVE Published:
23 July 2026

What is CVE-2026-16078?

The WCPOS – Point of Sale (POS) plugin for WooCommerce is susceptible to a Directory Traversal vulnerability due to improper handling of the 'type' parameter. Authenticated users with shop manager privileges can exploit this flaw to access confidential files on the server by manipulating requests with the context=edit parameter. This exploitation bypasses the content-stripping logic and allows the contents of the affected files to be returned verbatim in the REST API response, potentially exposing sensitive information and compromising security.

Affected Version(s)

WCPOS – Point of Sale (POS) plugin for WooCommerce 0 <= 1.9.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/woocommerce-po...
https://plugins.trac.wordpress.org/browser/woocommerce-po...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.