CVE-2026-17581
Received Received - Intake

Code Injection in WCPOS WooCommerce POS Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the Receipt_Renderer_Factory dispatching templates with the 'thermal' engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary PHP code into a template post that is subsequently written to a temporary file and executed via PHP's include(), resulting in remote code execution on the server. This requires the attacker to have Shop Manager-level access or above, as the template save path enforces a wcpos_template_settings nonce and the manage_woocommerce_pos capability check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-17581
EUVD
EUVD-2026-59905

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce wcp_pos to 1.9.14 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WCPOS – Point of Sale (POS) plugin for WooCommerce has a code injection flaw in versions up to 1.9.14. The vulnerability occurs because the plugin incorrectly uses a legacy PHP renderer for the 'thermal' template engine, allowing authenticated attackers with Shop Manager access or higher to inject arbitrary PHP code into a template. This code is then executed on the server, leading to remote code execution.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary code on your server, potentially taking full control of your WordPress site and any connected systems. This could lead to data theft, malware installation, or disruption of services. The attack requires Shop Manager-level access, so unauthorized users cannot exploit it directly.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. If exploited, it may result in data breaches, unauthorized modifications, or disclosure of protected information, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Update the WCPOS plugin to the latest version beyond 1.9.14 immediately. Remove Shop Manager-level access for users who do not require it. Review template files for unauthorized PHP code injections. Monitor server logs for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17581. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart