What is the CVSS score of EUVD-2026-59905?

EUVD-2026-59905 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of WooCommerce POS Plugin are affected by EUVD-2026-59905?

WCPOS Point of Sale plugin (versions ≤1.9.14) for WordPress/WooCommerce allows authenticated users with Shop Manager privileges to execute arbitrary PHP and achieve full server compromise.

How to fix or mitigate EUVD-2026-59905?

Within 24 hours: Audit all accounts with manage_woocommerce_pos capability; disable the plugin if not operationally essential. Within 7 days: If retention is required, restrict the manage_woocommerce_pos capability to only essential administrators, enable multi-factor authentication on all administrative WordPress accounts, implement WAF logging of Receipt_Renderer_Factory POST requests, and configure server-side audit logging of PHP include() calls. Within 30 days: Monitor WCPOS for security patches; establish ongoing monitoring of administrative actions and unusual PHP execution patterns; evaluate Point of Sale solutions with active security maintenance.

WooCommerce POS Plugin EUVD-2026-59905

| CVE-2026-17581 HIGH

Code Injection (CWE-94)

2026-08-16 Wordfence

GHSA-fq4g-jqvq-wx5r

PHP WordPress RCE Code Injection Wordpress Plugin Wcpos Point Of Sale Pos Plugin For Woocommerce Kilbot

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Shop Manager authentication (PR:H) is mandatory via nonce and capability check; network delivery of template payload via WordPress admin HTTP API; full server-side PHP execution yields complete CIA impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 06:17 vuln.today

CVE Published

Aug 16, 2026 - 05:27 cve.org

HIGH 7.2

DescriptionCVE.org

The WCPOS - Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the Receipt_Renderer_Factory dispatching templates with the 'thermal' engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary PHP code into a template post that is subsequently written to a temporary file and executed via PHP's include(), resulting in remote code execution on the server. This requires the attacker to have Shop Manager-level access or above, as the template save path enforces a wcpos_template_settings nonce and the manage_woocommerce_pos capability check.

AnalysisAI

Remote code execution in the WCPOS Point of Sale plugin for WordPress/WooCommerce (all versions through 1.9.14) allows authenticated Shop Manager-level users to inject and execute arbitrary PHP on the server. The flaw lies in Receipt_Renderer_Factory incorrectly routing 'thermal' engine templates to Legacy_Php_Renderer, which writes attacker-controlled content to a temporary file and executes it via PHP's include(). No public exploit or CISA KEV listing identified at time of analysis; however, full server compromise is achievable by any user holding the manage_woocommerce_pos capability.

Technical ContextAI

The affected component is the Receipt_Renderer_Factory class within the woocommerce-pos WordPress plugin by kilbot (CPE: cpe:2.3:a:kilbot:wcpos_-_point_of_sale_(pos)_plugin_for_woocommerce:*:*:*:*:*:*:*:*). The factory is responsible for dispatching receipt templates to the appropriate rendering engine. When a template specifies the 'thermal' engine type, the factory incorrectly routes it to Legacy_Php_Renderer instead of a dedicated, sandboxed thermal renderer. The Legacy_Php_Renderer (visible in plugin trac at tags/1.9.10 and 1.9.11 at includes/Services/Receipt_Renderer_Factory.php#L25 and includes/Templates/Renderers/Legacy_Php_Renderer.php#L42) writes the template body to a temporary file and executes it using PHP's native include() function, which evaluates embedded PHP tags as executable code. This is a textbook CWE-94 (Improper Control of Generation of Code) vulnerability: user-supplied template content is treated as trusted server-side code without sanitization or sandboxing.

RemediationAI

Upstream fix commit changeset 3634267 is referenced in the WordPress plugin trac (https://plugins.trac.wordpress.org/changeset?reponame=&old=3634267%40woocommerce-pos&new=3634267%40woocommerce-pos); however, the exact patched release version number is not independently confirmed from available data - administrators should monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/cf3efda0-8609-4a75-a00b-735b49ef260b) and the WordPress plugin repository for a version above 1.9.14. As an immediate compensating control, restrict the Shop Manager role assignment strictly to fully trusted personnel and audit all existing accounts holding the manage_woocommerce_pos capability; removing this capability from unnecessary accounts eliminates the attack surface entirely. Additionally, monitoring WordPress audit logs for unexpected template save operations in the POS template editor can detect exploitation attempts. Do not allow untrusted third-party access to Shop Manager accounts on affected installations until the patch is applied.