CVE-2026-17581 is a code injection vulnerability in the WCPOS – Point of Sale (POS) plugin for WooCommerce for WordPress. The issue exists in all versions up to and including 1.9.14 due to the Receipt_Renderer_Factory dispatching 'thermal' templates to the Legacy_Php_Renderer rather than a safe thermal-specific renderer. This allows authenticated attackers with Shop Manager-level access or higher, who pass the wcpos_template_settings nonce and manage_woocommerce_pos capability checks, to inject arbitrary PHP code into a template post. The injected code is written to a temporary file and executed via PHP's include(), resulting in remote code execution on the server.

Successful exploitation allows an attacker with Shop Manager-level privileges or higher to execute arbitrary PHP code on the server hosting the WooCommerce POS plugin. This can lead to full compromise of the affected system, including data theft, modification, or destruction, and potentially further network pivoting. The vulnerability requires authenticated access with specific capabilities, limiting exposure to authorized users only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Shop Manager-level access to trusted users only and monitor for suspicious activity related to template management. Avoid using the 'thermal' Template Engine if possible or disable the vulnerable functionality if configurable.