The WCPOS Point of Sale plugin for WooCommerce contains a directory traversal flaw that can be triggered via the 'type' parameter in its REST API. When the request includes the context=edit value, the plugin bypasses its usual content filtering logic and returns the specified file verbatim in the API response. This allows an attacker with at least shop manager‑level access to read any file on the server, potentially exposing configuration files, credentials, or other sensitive data.

All versions of the WCPOS plugin – Point of Sale – by kilbot, up to and including 1.9.8, are affected. The bug resides in the core PHP files within the API and Templates directories and is present in any WordPress installation that has this plugin enabled at one of these or earlier releases.

The vulnerability has a CVSS base score of 6.5, indicating moderate severity. Its EPSS score is less than 1%, suggesting a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Attacks require an authenticated user with shop manager or higher privileges who can supply the context=edit parameter. Successful exploitation lets the attacker read arbitrary files from the server and potentially obtain data that could enable further compromise.