Wcpos Point Of Sale Pos Plugin For Woocommerce
Monthly
Remote code execution in the WCPOS Point of Sale plugin for WordPress/WooCommerce (all versions through 1.9.14) allows authenticated Shop Manager-level users to inject and execute arbitrary PHP on the server. The flaw lies in Receipt_Renderer_Factory incorrectly routing 'thermal' engine templates to Legacy_Php_Renderer, which writes attacker-controlled content to a temporary file and executes it via PHP's include(). No public exploit or CISA KEV listing identified at time of analysis; however, full server compromise is achievable by any user holding the manage_woocommerce_pos capability.
Directory traversal in the WCPOS - Point of Sale plugin for WooCommerce (all versions through 1.9.8) allows authenticated shop managers to read arbitrary files from the server filesystem via the REST API. The vulnerability is exploited through the 'type' parameter in template-related API endpoints, with the critical bypass condition being the inclusion of 'context=edit' in the request, which suppresses the response sanitization layer and returns raw file contents. No public exploit code has been identified at time of analysis, and exploitation requires shop manager-level credentials, limiting opportunistic attack surface.
Remote code execution in the WCPOS Point of Sale plugin for WordPress/WooCommerce (all versions through 1.9.14) allows authenticated Shop Manager-level users to inject and execute arbitrary PHP on the server. The flaw lies in Receipt_Renderer_Factory incorrectly routing 'thermal' engine templates to Legacy_Php_Renderer, which writes attacker-controlled content to a temporary file and executes it via PHP's include(). No public exploit or CISA KEV listing identified at time of analysis; however, full server compromise is achievable by any user holding the manage_woocommerce_pos capability.
Directory traversal in the WCPOS - Point of Sale plugin for WooCommerce (all versions through 1.9.8) allows authenticated shop managers to read arbitrary files from the server filesystem via the REST API. The vulnerability is exploited through the 'type' parameter in template-related API endpoints, with the critical bypass condition being the inclusion of 'context=edit' in the request, which suppresses the response sanitization layer and returns raw file contents. No public exploit code has been identified at time of analysis, and exploitation requires shop manager-level credentials, limiting opportunistic attack surface.