What the vulnerability does
01Description
The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires supplying context=edit in the request, which bypasses the content-stripping logic in prepare_item_for_response() and returns the traversed file verbatim in the REST API response.
Explanation of Vulnerability in Simple Terms
02Summary
WCPOS – Point of Sale plugin for WooCommerce versions 1.9.8 and earlier contain a path traversal vulnerability. An authenticated attacker with low privileges can read arbitrary files from the server by manipulating file path parameters. This allows access to sensitive configuration files, database credentials, and other protected data without modifying or disrupting the site.
What an attacker can do
03Attacker Capabilities
Read arbitrary files from the server, including configuration and credential files.
Potential impact on your site
04Site Impact
Sensitive files like wp-config.php and database credentials may be exposed to authenticated users with low privileges.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege authenticated account on the WooCommerce site.
Key dates
06Disclosure timeline
July 23, 2026
CVE published
July 23, 2026
Record updated
