Plugins · woocommerce-pos · data as of 2026-11-04
Is WCPOS safe? Known vulnerabilities and latest version
- Latest version
- 1.11.9
- Last updated
- 2026-11-01
- Active installs
- 5,000+
- Known issues on record
- 5
- Unpatched in latest
- 0
- Tested up to WP
- 7.1.4 · PHP 7.4+
Turn any device into a register for your WooCommerce store — same catalog, stock and prices, online or off. — by kilbot
What to do
- Update to the latest version (1.11.9). Anything older than 1.9.15 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
- If you cannot update right away, deactivate it until you can.
- Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.
With WP-CLI: wp plugin get woocommerce-pos --field=version shows what you run; wp plugin update woocommerce-pos updates it.
Check your version
Known vulnerabilities
5 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.
high 7.2 CVE-2026-17581 · published 2026-08-16
Remote code execution in WCPOS (1.9.14 and older)
- Affected
- 1.9.14 and older
- Fixed in
- 1.9.15 *
- Access needed (per CVSS)
- Needs an admin-level account
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the Receipt_Renderer_Factory dispatching templates with the 'thermal' engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject arbitrary PHP code into a template post that is subsequently written to a temporary file and executed via PHP's include(), resulting in remote code execution on the server. This requires the attacker to have Shop Manager-level access or above, as the template save path enforces a wcpos_template_settings nonce and the manage_woocommerce_pos capability check.
NVD CVE-2026-17581Wordfence advisoryCode change (fix)Plugin source
medium 6.5 CVE-2026-16078 · published 2026-07-23
Path traversal / file read in WCPOS (1.9.8 and older)
- Affected
- 1.9.8 and older
- Fixed in
- 1.9.9 *
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires supplying context=edit in the request, which bypasses the content-stripping logic in prepare_item_for_response() and returns the traversed file verbatim in the REST API response.
NVD CVE-2026-16078Wordfence advisoryCode change (fix)Plugin source
high 7.5 CVE-2026-52711 · published 2026-06-16
Missing authorization check in WCPOS (1.8.14 and older)
- Affected
- 1.8.14 and older
- Fixed in
- 1.9.0
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.
medium 5.3 CVE-2025-48117 · published 2025-05-16
Missing authorization check in WCPOS (1.7.8 and older)
- Affected
- 1.7.8 and older
- Fixed in
- 1.7.9
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Missing Authorization vulnerability in kilbot WooCommerce POS woocommerce-pos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce POS: from n/a through <= 1.7.8.
medium 4.3 CVE-2024-2384 · published 2024-03-20
Information disclosure in WCPOS (1.4.11 and older)
- Affected
- 1.4.11 and older
- Fixed in
- 1.4.12 *
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber)
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The WooCommerce POS plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.4.11. This is due to the plugin not properly verifying the authentication and authorization of the current user This makes it possible for authenticated attackers, with customer-level access and above, to view potentially sensitive information about other users by leveraging their order id
Recent activity
- 2026-11-01 — latest release on wordpress.org (1.11.9).
- 2026-08-16 — Remote code execution disclosed (CVE-2026-17581), fixed in 1.9.15.
- 2026-07-23 — Path traversal / file read disclosed (CVE-2026-16078), fixed in 1.9.9.
- 2026-06-16 — Missing authorization check disclosed (CVE-2026-52711), fixed in 1.9.0.
Get an email when WCPOS has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for WCPOS (woocommerce-pos) is published or a fix ships. Unsubscribe in one click.
Browse vulnerabilities
Types found in this plugin: Missing authorization (2) · Remote code execution (1) · Path traversal and file read (1) · Sensitive data exposure (1)
Where this data comes from
- Version, last update, installs: wordpress.org/plugins/woocommerce-pos (Plugins API), fetched 2026-11-04.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/woocommerce-pos"><img src="https://laskyr.com/plugins/woocommerce-pos/badge.svg" alt="WCPOS vulnerability status"></a>