Authenticated code execution via thermal template dispatch

Code injection in WCPOS – Point of Sale for WooCommerce before 1.9.15 allows remote authenticated users to execute PHP via thermal receipt templates. Receipt_Renderer_Factory routes templates marked for the thermal engine to Legacy_Php_Renderer, which writes template post content to a temporary file and executes it with include() instead of using the safe thermal Mustache/XML renderer. Reachability is limited to Shop Manager-level and higher users who can satisfy the wcpos_template_settings nonce and manage_woocommerce_pos capability check, but successful exploitation yields server-side code execution in the WordPress context.