CVE-2026-17581

Name of the Vulnerable Software and Affected Versions WCPOS – Point of Sale (POS) plugin for WooCommerce versions prior to 1.9.15

Description Authenticated attackers with Shop Manager-level access or higher can perform code injection through the 'thermal' Template Engine. The issue occurs because the Receipt Renderer Factory dispatches templates using the 'thermal' engine to the Legacy Php Renderer instead of a secure thermal-specific renderer. This allows an attacker to inject arbitrary PHP code into a template post, which is then written to a temporary file and executed via the include() function, leading to remote code execution on the server. This process is protected by a wcpos template settings nonce and a manage woocommerce pos capability check.

Recommendations Update to a version newer than 1.9.14.