Description

The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the Receipt_Renderer_Factory dispatching templates with the 'thermal' engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary PHP code into a template post that is subsequently written to a temporary file and executed via PHP's include(), resulting in remote code execution on the server. This requires the attacker to have Shop Manager-level access or above, as the template save path enforces a wcpos_template_settings nonce and the manage_woocommerce_pos capability check.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-16T06:16:51.440Z",
  "pubdate": "2026-08-16T06:16:51.440Z",
  "executiveSummary": "The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to an authenticated Code Injection vulnerability affecting all versions up to, and including, 1.9.14.\nThe flaw exists due to insecure handling of the 'thermal' Template Engine by the Receipt_Renderer_Factory, which incorrectly dispatches templates to the Legacy_Php_Renderer instead of a secure, isolated renderer.\nAn authenticated attacker with Shop Manager-level access and above can leverage this vulnerability to inject arbitrary PHP code into a template post.\nThis injected payload is subsequently written to a temporary file on the underlying filesystem and executed via PHP's include() function, directly leading to remote code execution on the server.\nSuccessful exploitation requires authenticated access with the manage_woocommerce_pos capability, alongside the enforcement of a valid wcpos_template_settings nonce.\nThe potential impact includes complete server compromise, unauthorized data access, and full control over the underlying WordPress installation.",
  "technicalDetails": "The vulnerability resides in the WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress, specifically within the template rendering logic implemented across all versions up to, and including, 1.9.14.\nThe root cause stems from the Receipt_Renderer_Factory component, which is responsible for dispatching template engines based on configuration inputs.\nWhen processing templates configured with the 'thermal' Template Engine, the Receipt_Renderer_Factory improperly delegates execution to the Legacy_Php_Renderer instead of utilizing a dedicated, safe thermal-specific renderer.\nBecause the Legacy_Php_Renderer handles the data as raw PHP code, it introduces a severe Code Injection vulnerability.\nThe exploitation method requires an attacker to possess authenticated access with Shop Manager-level privileges or higher, specifically needing the manage_woocommerce_pos capability.\nAdditionally, the attack vector requires bypassing or successfully generating the wcpos_template_settings nonce enforced by the template save path mechanism.\nThe step-by-step attack flow begins with the authenticated attacker crafting a malicious template payload containing arbitrary PHP code.\nThe attacker submits this payload to update or create a template post within the application, successfully passing the nonce verification and capability checks.\nUpon rendering or processing the template post, the Receipt_Renderer_Factory routes the 'thermal' template to the Legacy_Php_Renderer.\nThe Legacy_Php_Renderer processes the template content and writes it out to a temporary file on the server filesystem.\nFinally, the application invokes PHP's include() function on this newly written temporary file, causing the embedded malicious PHP code to execute in the context of the web server process.\nThis behavior results in remote code execution, granting the attacker the ability to execute arbitrary system commands, read sensitive files, or pivot deeper into the internal network infrastructure."
}