Answer in brief
CVE-2026-17581 records a Unknown severity vulnerability in WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine. The current sources do not mark it as known exploited. The current feed maps kilbot/WCPOS – Point of Sale (POS) plugin for WooCommerce (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-17581 records a Unknown severity vulnerability in WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine. The current sources do not mark it as known exploited. The current feed maps kilbot/WCPOS – Point of Sale (POS) plugin for WooCommerce (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps kilbot/WCPOS – Point of Sale (POS) plugin for WooCommerce (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| kilbot/WCPOS – Point of Sale (POS) plugin for WooCommercegeneric | 0 | Not reported |
Published upstream
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 16, 2026
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the Receipt_Renderer_Factory dispatching templates with the 'thermal' engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary PHP code into a template post that is subsequently written to a temporary file and executed via PHP's include(), resulting in remote code execution on the server. This requires the attacker to have Shop Manager-level access or above, as the template save path enforces a wcpos_template_settings nonce and the manage_woocommerce_pos capability check.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps kilbot/WCPOS – Point of Sale (POS) plugin for WooCommerce (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| kilbot/WCPOS – Point of Sale (POS) plugin for WooCommercegeneric | 0 | Not reported |
Published upstream
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 16, 2026
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the Receipt_Renderer_Factory dispatching templates with the 'thermal' engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary PHP code into a template post that is subsequently written to a temporary file and executed via PHP's include(), resulting in remote code execution on the server. This requires the attacker to have Shop Manager-level access or above, as the template save path enforces a wcpos_template_settings nonce and the manage_woocommerce_pos capability check.
Quoted source text, attributed separately from HOL analysis.