CVE-2026-17581 (GCVE-0-2026-17581)
Vulnerability from cvelistv5
Published
2026-08-16 05:27
Modified
2026-08-17 19:28
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the Receipt_Renderer_Factory dispatching templates with the 'thermal' engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary PHP code into a template post that is subsequently written to a temporary file and executed via PHP's include(), resulting in remote code execution on the server. This requires the attacker to have Shop Manager-level access or above, as the template save path enforces a wcpos_template_settings nonce and the manage_woocommerce_pos capability check.
References
Impacted products
Vendor Product Version
kilbot WCPOS – Point of Sale (POS) plugin for WooCommerce Version: 0   ≤ 1.9.14
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17581",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T19:25:13.337195Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T19:28:52.736Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WCPOS \u2013 Point of Sale (POS) plugin for WooCommerce",
          "vendor": "kilbot",
          "versions": [
            {
              "lessThanOrEqual": "1.9.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WCPOS \u2013 Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the \u0027thermal\u0027 Template Engine in all versions up to, and including, 1.9.14 due to the Receipt_Renderer_Factory dispatching templates with the \u0027thermal\u0027 engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary PHP code into a template post that is subsequently written to a temporary file and executed via PHP\u0027s include(), resulting in remote code execution on the server. This requires the attacker to have Shop Manager-level access or above, as the template save path enforces a wcpos_template_settings nonce and the manage_woocommerce_pos capability check."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-16T05:27:31.380Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf3efda0-8609-4a75-a00b-735b49ef260b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Services/Receipt_Renderer_Factory.php#L25"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Templates/Renderers/Legacy_Php_Renderer.php#L42"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Services/Receipt_Renderer_Factory.php#L25"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Admin/Templates/Single_Template.php#L456"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Templates.php#L238"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Templates/Receipt.php#L251"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Templates/Renderers/Legacy_Php_Renderer.php#L42"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Admin/Templates/Single_Template.php#L456"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Templates.php#L238"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Templates/Receipt.php#L251"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3634267%40woocommerce-pos\u0026new=3634267%40woocommerce-pos"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-27T16:03:11.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-15T17:26:58.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WCPOS \u003c= 1.9.14 - Authenticated (Shop Manager+) Code Injection via \u0027thermal\u0027 Template Engine"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-17581",
    "datePublished": "2026-08-16T05:27:31.380Z",
    "dateReserved": "2026-07-27T15:48:04.409Z",
    "dateUpdated": "2026-08-17T19:28:52.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-17581\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-17T19:25:13.337195Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-17T19:28:00.771Z\"}}], \"cna\": {\"title\": \"WCPOS \u003c= 1.9.14 - Authenticated (Shop Manager+) Code Injection via \u0027thermal\u0027 Template Engine\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Wordfence PRISM\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"kilbot\", \"product\": \"WCPOS \\u2013 Point of Sale (POS) plugin for WooCommerce\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.9.14\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-07-27T16:03:11.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-08-15T17:26:58.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/cf3efda0-8609-4a75-a00b-735b49ef260b?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Services/Receipt_Renderer_Factory.php#L25\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Templates/Renderers/Legacy_Php_Renderer.php#L42\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Services/Receipt_Renderer_Factory.php#L25\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Admin/Templates/Single_Template.php#L456\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Templates.php#L238\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.11/includes/Templates/Receipt.php#L251\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Templates/Renderers/Legacy_Php_Renderer.php#L42\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Admin/Templates/Single_Template.php#L456\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Templates.php#L238\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/woocommerce-pos/tags/1.9.10/includes/Templates/Receipt.php#L251\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3634267%40woocommerce-pos\u0026new=3634267%40woocommerce-pos\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The WCPOS \\u2013 Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the \u0027thermal\u0027 Template Engine in all versions up to, and including, 1.9.14 due to the Receipt_Renderer_Factory dispatching templates with the \u0027thermal\u0027 engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary PHP code into a template post that is subsequently written to a temporary file and executed via PHP\u0027s include(), resulting in remote code execution on the server. This requires the attacker to have Shop Manager-level access or above, as the template save path enforces a wcpos_template_settings nonce and the manage_woocommerce_pos capability check.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-08-16T05:27:31.380Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-17581\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-17T19:28:52.736Z\", \"dateReserved\": \"2026-07-27T15:48:04.409Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-08-16T05:27:31.380Z\", \"assignerShortName\": \"Wordfence\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.