CVE-2026-17581 is a code injection vulnerability (CWE-94) in the WCPOS – Point of Sale (POS) plugin for WooCommerce, affecting all versions up to and including 1.9.14. The issue arises from the Receipt_Renderer_Factory dispatching 'thermal' engine templates to the Legacy_Php_Renderer instead of a secure thermal-specific renderer. Authenticated attackers with Shop Manager-level permissions or higher can inject arbitrary PHP code into a template post. This code is saved to a temporary file and executed via PHP's include(), resulting in remote code execution on the server. The attack requires passing a nonce and capability check, limiting exploitation to privileged users.

Successful exploitation allows an authenticated attacker with Shop Manager-level access or higher to execute arbitrary PHP code on the server hosting the WooCommerce POS plugin. This can lead to full compromise of the web server, data theft, or further attacks within the environment. The vulnerability has a CVSS 3.1 score of 7.2 (high severity), reflecting its potential for remote code execution with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Shop Manager-level access to trusted users only. Monitor for updates from the vendor kilbot regarding an official patch or workaround. Avoid using the 'thermal' Template Engine if possible, or disable the vulnerable functionality if configurable.