What is the CVSS score of CVE-2026-16078?

CVE-2026-16078 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.9%.

WCPOS WooCommerce Plugin CVE-2026-16078

EUVD-2026-47928 MEDIUM

Path Traversal (CWE-22)

2026-07-23 Wordfence

GHSA-4h8p-8qhg-5wv2

WordPress Path Traversal Wordpress Plugin Wcpos Point Of Sale Pos Plugin For Woocommerce Kilbot

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network REST API vector, low privilege (shop manager required), no user interaction; pure confidentiality impact via file read, no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 09:46 vuln.today

CVE Published

Jul 23, 2026 - 08:34 cve.org

MEDIUM 6.5

DescriptionCVE.org

The WCPOS - Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires supplying context=edit in the request, which bypasses the content-stripping logic in prepare_item_for_response() and returns the traversed file verbatim in the REST API response.

AnalysisAI

Directory traversal in the WCPOS - Point of Sale plugin for WooCommerce (all versions through 1.9.8) allows authenticated shop managers to read arbitrary files from the server filesystem via the REST API. The vulnerability is exploited through the 'type' parameter in template-related API endpoints, with the critical bypass condition being the inclusion of 'context=edit' in the request, which suppresses the response sanitization layer and returns raw file contents. No public exploit code has been identified at time of analysis, and exploitation requires shop manager-level credentials, limiting opportunistic attack surface.

Technical ContextAI

The affected code resides in the plugin's REST API controller (Templates_Controller.php) and template loader (Templates.php), specifically in the logic that handles template file retrieval. The 'type' parameter is used to select which template file to load, and the implementation fails to sanitize or canonicalize the path before reading from disk - a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, aka Path Traversal) root cause. The bypass mechanism is architecturally notable: the prepare_item_for_response() method contains content-stripping logic intended to sanitize output, but when 'context=edit' is passed in the request (a standard WooCommerce REST API context parameter), this sanitization is bypassed, allowing the raw traversed file content to be returned verbatim in the JSON REST API response. The CPE is cpe:2.3:a:kilbot:wcpos_-_point_of_sale_(pos)_plugin_for_woocommerce:*:*:*:*:*:*:*:* (vendor: kilbot). Source code references confirm the vulnerable logic at Templates_Controller.php lines 446 and 1497, and Templates.php lines 445 and 481 in the 1.9.7 tag.

RemediationAI

An upstream fix has been committed to the WordPress plugin repository (changeset reference: https://plugins.trac.wordpress.org/changeset?reponame=&old=3612715%40woocommerce-pos&new=3612715%40woocommerce-pos); however, the exact released patched version number is not independently confirmed from the available data - verify the current version in the WordPress plugin repository and update to the latest release above 1.9.8. Until patched, compensating controls include: restricting or auditing shop manager account assignments to minimize the number of trusted principals who could exploit this flaw (reducing the risk that a compromised or malicious employee leverages it); implementing a Web Application Firewall (WAF) rule to detect and block REST API requests containing path traversal sequences (e.g., '../') in the 'type' parameter; and ensuring sensitive files like wp-config.php use WordPress hardening measures (e.g., moving wp-config.php above the web root, restricting read permissions to the web process user only). Note that the WAF mitigation may interfere with legitimate template management functionality if the plugin uses path-like values in the 'type' parameter for valid use cases.