The WCPOS – Point of Sale plugin for WooCommerce contains a code injection flaw (CWE‑94) within the "thermal" Template Engine. By default, the Receipt_Renderer_Factory incorrectly dispatches templates that use the 'thermal' engine to the Legacy_Php_Renderer. This renderer writes the template to a temporary file and executes it with PHP's include(), giving an attacker the ability to inject arbitrary PHP code. The flaw is limited to authenticated users with Shop Manager level or higher access, who control template content and the triggering of the renderer. As a result, an attacker can achieve remote code execution with the privileges of the web server, potentially compromising the entire WordPress site and any databases or services it supports.

All installations of the kilbot WCPOS – Point of Sale plugin for WooCommerce with versions 1.9.14 or earlier are impacted. The vulnerability is present in every release up to and including 1.9.14, and is associated with file locations such as /includes/Admin/Templates/Single_Template.php and /includes/Services/Receipt_Renderer_Factory.php. Users of any WordPress site running WooCommerce with the WCPOS plugin in this version range should review their installations.

The CVSS v3.1 score for this vulnerability is 7.2, indicating a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker already possess Shop Manager or higher credentials, which allows saving custom receipt templates. Once a malicious template is submitted, the server automatically writes it to a temporary file and includes it, resulting in remote code execution. The lack of a KEV listing and the absence of a publicly available exploit do not lower the seriousness; if credentials are available, the situation is severe.