Code Injection Vulnerability in WCPOS Plugin for WooCommerce

CVE-2026-17581

What is CVE-2026-17581?

The WCPOS – Point of Sale (POS) plugin for WooCommerce exposes a critical security vulnerability that enables code injection via the 'thermal' Template Engine. This flaw exists in all versions up to and including 1.9.14, where the Receipt_Renderer_Factory improperly dispatches templates to the Legacy_Php_Renderer instead of utilizing a dedicated and secure thermal renderer. Consequently, this oversight allows authenticated users with Shop Manager-level access or higher to inject arbitrary PHP code into a template post. The malicious code can be executed through PHP’s include() function once written to a temporary file, leading to potential remote code execution on the server.

References