CVE-2026-16078

Name of the Vulnerable Software and Affected Versions WCPOS – Point of Sale (POS) plugin for WooCommerce versions prior to 1.9.9

Description A Directory Traversal issue exists where authenticated attackers with shop manager-level access or higher can read arbitrary files on the server. This is achieved via the type parameter. Exploitation requires including context=edit in the request to bypass the content-stripping logic within the prepare item for response() function, allowing the REST API to return the file contents verbatim.

Recommendations Update the plugin to version 1.9.9 or later.