Description

The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires supplying context=edit in the request, which bypasses the content-stripping logic in prepare_item_for_response() and returns the traversed file verbatim in the REST API response.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-07-23T10:16:51.727Z",
  "pubdate": "2026-07-23T10:16:51.727Z",
  "executiveSummary": "The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to a Directory Traversal vulnerability affecting all versions up to, and including, 1.9.8. This security flaw originates from insufficient sanitization of user-supplied input within the 'type' parameter exposed through the plugin's REST API endpoints.\nThe vulnerability allows authenticated attackers possessing shop manager-level access and above to traverse the server's file system and read arbitrary files. Successful exploitation leads to the disclosure of sensitive system configuration files, database credentials, and other confidential data residing on the underlying server.\nExploitation requires the attacker to specifically supply the context=edit parameter within the HTTP request. This specific input successfully bypasses the content-stripping logic executed by the prepare_item_for_response() function, forcing the application to return the contents of the traversed file verbatim directly within the REST API response.\nGiven the requirement for privileged access (shop manager or higher), the immediate risk is localized to authenticated actors; however, compromised administrative accounts or malicious insiders can leverage this flaw for severe information disclosure, escalating the potential security impact across the affected WordPress installation.",
  "technicalDetails": "The vulnerability resides in the WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress, specifically affecting all versions up to, and including, 1.9.8. The root cause of the flaw is improper neutralization of special elements used in a file path, commonly known as Directory Traversal or Path Traversal.\nThe affected component fails to adequately validate and sanitize the 'type' parameter supplied by users during interactions with the plugin's REST API. In standard operational flows, the application is expected to restrict file access to designated directories. However, improper handling of relative path sequences (such as ../) allows attackers to break out of the intended web root directory.\nAttack execution requires an authenticated attacker with shop manager-level privileges or higher. To trigger the vulnerability, the attacker must issue a crafted HTTP request to the vulnerable REST API endpoint containing path traversal sequences within the 'type' parameter.\nA critical aspect of the attack flow involves supplying the 'context=edit' parameter in the request. This specific parameter value acts as a bypass mechanism. When processed, 'context=edit' instructs the application to bypass the standard content-stripping logic implemented within the prepare_item_for_response() function.\nOrdinarily, the prepare_item_for_response() function would sanitize, filter, or strip sensitive payloads from the API response. By bypassing this function via the edit context, the application processes the file read operation and returns the contents of the arbitrarily requested file verbatim within the body of the REST API response.\nThe post-exploitation impact includes the unauthorized reading of sensitive server-side files, such as wp-config.php, system logs, or underlying operating system files depending on file permissions. This unauthorized information disclosure can facilitate further attacks, including privilege escalation, remote code execution, or complete system compromise."
}