CVE-2026-16078 Overview
CVE-2026-16078 is a directory traversal vulnerability [CWE-22] in the WCPOS – Point of Sale (POS) plugin for WooCommerce, affecting all WordPress plugin versions up to and including 1.9.8. Authenticated attackers with shop manager-level access or higher can abuse the type parameter in the plugin's REST API to read arbitrary files on the underlying server. Successful exploitation requires supplying context=edit in the request, which bypasses the content-stripping logic in prepare_item_for_response() and returns the traversed file verbatim. Sensitive files such as wp-config.php, private keys, and system configuration data can be exfiltrated through the REST API response.
Critical Impact
Authenticated shop managers can read arbitrary server files, including WordPress credentials and secrets, enabling further compromise of the site and connected infrastructure.
Affected Products
- WordPress plugin: WCPOS – Point of Sale (POS) plugin for WooCommerce
- All versions up to and including 1.9.8
- Vulnerable REST endpoint served by Templates_Controller.php
Discovery Timeline
- 2026-07-23 - CVE-2026-16078 published to the National Vulnerability Database (NVD)
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-16078
Vulnerability Analysis
The WCPOS plugin exposes a REST API for retrieving printable templates used by the point-of-sale interface. The controller code in includes/API/Templates_Controller.php accepts a type parameter that is concatenated into a filesystem path when the underlying template file is resolved in includes/Templates.php. The plugin does not validate or normalize this parameter, so path traversal sequences such as ../ are honored during file resolution.
When a request is issued with context=edit, the response handler skips the sanitization step that would otherwise strip the raw file contents. As a result, the REST API returns the full contents of the traversed file. Any authenticated user with shop manager privileges — a role commonly delegated to store staff — can trigger the flaw. The impact is limited to disclosure of file contents, but that scope covers WordPress secrets, database credentials, and any file readable by the PHP process.
Root Cause
The root cause is missing input validation on the type parameter before it is used to build a filesystem path. The controller trusts client-supplied input and combines it with the templates directory without canonicalizing the result or restricting resolution to an allow-list of known template names.
Attack Vector
Exploitation is performed remotely over the network against the WordPress REST API. The attacker authenticates as a user with the shop manager role or higher, then issues a GET request to the templates endpoint supplying a traversal payload in the type parameter along with context=edit. The server returns the target file's contents in the JSON response. No user interaction is required beyond authentication.
The vulnerability manifests in the template resolution path referenced by the vendor's source at Templates_Controller.php line 446 and Templates.php line 445. See the Wordfence Vulnerability Report and the WordPress WooCommerce POS Changeset for the patch diff.
Detection Methods for CVE-2026-16078
Indicators of Compromise
- REST API requests to the WCPOS templates endpoint containing traversal sequences such as ../, ..%2f, or encoded variants in the type query parameter.
- Requests to the templates endpoint that include context=edit from accounts not typically performing template edits.
- Web server or PHP logs showing successful reads of sensitive files such as wp-config.php, /etc/passwd, or SSH keys immediately following authenticated WCPOS API calls.
Detection Strategies
- Inspect WordPress access logs for GET requests to /wp-json/ paths belonging to the woocommerce-pos plugin that contain type= values with dot-dot or URL-encoded path characters.
- Alert on shop manager or administrator accounts issuing high volumes of templates API requests, particularly those returning HTTP 200 with large response bodies.
- Correlate authentication events with subsequent REST API traversal patterns to identify compromised or malicious low-privilege store operators.
Monitoring Recommendations
- Enable verbose logging of REST API requests and responses on hosts running WooCommerce with the WCPOS plugin installed.
- Deploy a web application firewall (WAF) rule that blocks path traversal patterns on /wp-json/wcpos/* endpoints.
- Monitor file integrity and access telemetry for reads of WordPress secrets and OS-level configuration files by the PHP-FPM or web server user.
How to Mitigate CVE-2026-16078
Immediate Actions Required
- Update the WCPOS – Point of Sale (POS) plugin for WooCommerce to a version released after 1.9.8 that contains the traversal fix committed in changeset 3612715.
- Audit shop manager and administrator accounts, remove unused accounts, and enforce strong unique passwords and multi-factor authentication.
- Rotate any secrets stored in wp-config.php, including database credentials and WordPress authentication salts, if exposure is suspected.
Patch Information
The vendor addressed the flaw in the changeset published at WordPress WooCommerce POS Changeset 3612715. The fix validates the type parameter against an allow-list and restricts path resolution to the plugin's templates directory. Site owners should upgrade the plugin through the WordPress admin dashboard or via WP-CLI to install the patched release.
Workarounds
- Restrict the shop manager role to a minimal set of trusted users until the plugin is upgraded.
- Deploy a WAF signature that rejects type parameters containing .., %2e%2e, or backslash sequences on WCPOS REST endpoints.
- Temporarily disable the WCPOS plugin on production sites that cannot patch immediately and cannot mitigate at the WAF layer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
