Live › vulnerability › CVE-2026-120563
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress has an SQL injection flaw in its currency exchange rate handling in all versions up to and including 5.5.7. An authenticated attacker with a low-privilege account can store a malicious payload that is later run in an ORDER BY clause, letting them extract sensitive data from the site's database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 05:48 UTC. All times on this page are UTC.
Sites running WordPress with the WooCommerce Multilingual & Multicurrency with WPML plugin at version 5.5.7 or earlier. The flaw needs an authenticated account, and the description says subscriber-level users can store the payload, so exposure depends on who can register or log in to the site. Sites without this plugin can skip it.
No product ranges from the sources yet.
5.5.7 and earlier are listed as affected.5.5.7 (fixed version not stated in the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the save_currency() AJAX handler, which lacks capability checks and allows subscriber-level users to store malicious SQL payloads that are later concatenated directly into ORDER BY clauses without proper sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries to extract sensitive information from the database.
This page as .md · .json · in your agent: get_signal("CVE-2026-120563")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.