CVE-2026-17581

The WCPOS plugin for WooCommerce contains a template engine dispatch vulnerability that allows authenticated Shop Managers to achieve remote code execution through a fallback rendering mechanism. The vulnerability stems from the plugin's multi-engine template system: when a template engine identifier is dispatched that has no corresponding renderer (in this case, the 'thermal' engine), the code falls back to PHP rendering — executing the template content as PHP code rather than treating it as static markup. This is not a simple coding oversight. The dispatch logic was designed with a permissive fallback, likely justified during development as 'flexibility' or 'forward compatibility.' The thermal engine identifier was added to the router, but the actual renderer was never implemented. The abandoned feature scaffolding remained in production code across multiple versions (1.9.14 and prior), creating an exploitable execution path. The Shop Manager access requirement does not meaningfully reduce severity. WooCommerce deployments frequently grant this role to non-technical staff, contractors, and support personnel. The attack surface includes compromised admin sessions, insider threats, and social engineering — the documented history of phishing campaigns against WooCommerce store managers demonstrates that 'high privilege' requirements systematically underestimate real-world exposure. Audit your WCPOS installation: locate the template dispatch logic (typically in a Template_Renderer or similar class), identify all registered engine identifiers, and verify that each has a corresponding renderer implementation. If any engine identifier exists without a renderer, it is currently falling through to PHP execution. The fix requires either implementing the missing renderer with safe output encoding, or removing the engine identifier entirely — not adding a fail-closed error handler, which would break legitimate functionality that shop managers require for receipt customization.

Reviewed through automated stages and approved by a human before publication.