{"id":"CVE-2026-120563","kind":"vulnerability","aliases":["CVE-2026-120563"],"related":[],"title":"WooCommerce Multilingual WPML plugin: SQL injection lets logged-in users read database","description":"The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the save_currency() AJAX handler, which lacks capability checks and allows subscriber-level users to store malicious SQL payloads that are later concatenated directly into ORDER BY clauses without proper sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries to extract sensitive information from the database.","summary":"The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress has an SQL injection flaw in its currency exchange rate handling in all versions up to and including 5.5.7. An authenticated attacker with a low-privilege account can store a malicious payload that is later run in an ORDER BY clause, letting them extract sensitive data from the site's database.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","woocommerce","wordpress","wpml"],"not_affected_if":["plugin-above-5.5.7","plugin-not-installed"],"how_to_check":"- Check the installed version of WooCommerce Multilingual & Multicurrency with WPML in the WordPress plugins screen or the plugin's main file header; `5.5.7` and earlier are listed as affected.\n- Review user accounts with subscriber or shop manager roles and confirm they are trusted.","fix":"- WooCommerce Multilingual & Multicurrency with WPML: versions after `5.5.7` (fixed version not stated in the sources).","status":"open","published_at":"2026-11-03T05:18:33+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","triaged_at":"2026-11-03T05:50:03+00:00","updated_at":"2026-11-03T05:50:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T05:50:03Z","model":"claude-haiku-5-5","output":{"fix":"- WooCommerce Multilingual & Multicurrency with WPML: versions after `5.5.7` (fixed version not stated in the sources).","reach":"internet","title":"WooCommerce Multilingual WPML plugin: SQL injection lets logged-in users read database","impact":"medium","summary":"The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress has an SQL injection flaw in its currency exchange rate handling in all versions up to and including 5.5.7. An authenticated attacker with a low-privilege account can store a malicious payload that is later run in an ORDER BY clause, letting them extract sensitive data from the site's database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","wpml"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker extracts sensitive database contents through injected SQL queries","analyst_note":"","how_to_check":"- Check the installed version of WooCommerce Multilingual & Multicurrency with WPML in the WordPress plugins screen or the plugin's main file header; `5.5.7` and earlier are listed as affected.\n- Review user accounts with subscriber or shop manager roles and confirm they are trusted.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-above-5.5.7"],"who_is_affected":"Sites running WordPress with the WooCommerce Multilingual & Multicurrency with WPML plugin at version 5.5.7 or earlier. The flaw needs an authenticated account, and the description says subscriber-level users can store the payload, so exposure depends on who can register or log in to the site. Sites without this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00075,"input_tokens":4238,"output_tokens":652,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120563':16A,19A '-2026':15A,18A '5.5.7':51B,106C 'access':165C 'account':60B 'addit':170C 'ajax':124C 'allow':131C 'append':169C 'attack':54B,159C 'authent':53B,158C 'capabl':128C 'check':129C 'claus':74B,149C 'concaten':144C 'currenc':40B,116C,123C 'cve':14A,17A 'data':79B 'databas':13A,84B,179C 'direct':145C 'due':109C 'exchang':41B,117C 'extract':77B,174C 'flaw':37B 'handl':43B 'handler':125C 'includ':50B,105C 'inform':176C 'inject':6A,36B,98C 'input':112C 'insuffici':111C 'lack':127C 'later':68B,143C 'let':7A,75B 'level':134C,164C 'log':9A 'logged-in':8A 'low':58B 'low-privileg':57B 'make':154C 'malici':64B,138C 'manag':163C 'manager-level':162C 'multicurr':27B,88C 'multilingu':2A,26B,87C 'order':72B,147C 'packag':20B 'paramet':119C 'payload':65B,140C 'plugin':4A,30B,91C 'possibl':156C 'privileg':59B 'proper':151C 'queri':172C 'rate':42B,118C 'read':12A 'run':69B 'sanit':152C 'save':122C 'sensit':78B,175C 'shop':161C 'site':82B 'sql':5A,35B,97C,139C,171C 'store':62B,137C 'subscrib':133C 'subscriber-level':132C 'user':11A,135C 'valid':113C 'version':46B,101C 'vulner':95C 'without':150C 'woocommerc':1A,21B,25B,86C 'wordpress':22B,32B,93C 'wpml':3A,23B,29B,90C","nicknames":[],"mitigations":[],"who_affected":"Sites running WordPress with the WooCommerce Multilingual & Multicurrency with WPML plugin at version 5.5.7 or earlier. The flaw needs an authenticated account, and the description says subscriber-level users can store the payload, so exposure depends on who can register or log in to the site. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","woocommerce","wordpress","wpml"],"first_public_at":"2026-11-03T05:18:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120563","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120563","severity":null,"published_at":"2026-11-03T05:18:33+00:00","modified_at":"2026-11-03T05:18:33+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","fetched_at":"2026-11-03T05:48:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}