---
id: "CVE-2026-120563"
kind: "vulnerability"
aliases: ["CVE-2026-120563"]
title: "WooCommerce Multilingual WPML plugin: SQL injection lets logged-in users read database"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "woocommerce", "wordpress", "wpml"]
not_affected_if: ["plugin-above-5.5.7", "plugin-not-installed"]
published_at: "2026-11-03T05:18:33+00:00"
first_seen_at: "2026-11-03T05:48:53+00:00"
updated_at: "2026-11-03T05:50:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120563", "first_seen_at": "2026-11-03T05:48:53+00:00"}]
---

# WooCommerce Multilingual WPML plugin: SQL injection lets logged-in users read database

The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress has an SQL injection flaw in its currency exchange rate handling in all versions up to and including 5.5.7. An authenticated attacker with a low-privilege account can store a malicious payload that is later run in an ORDER BY clause, letting them extract sensitive data from the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of WooCommerce Multilingual & Multicurrency with WPML in the WordPress plugins screen or the plugin's main file header; `5.5.7` and earlier are listed as affected.
- Review user accounts with subscriber or shop manager roles and confirm they are trusted.

## Fix

- WooCommerce Multilingual & Multicurrency with WPML: versions after `5.5.7` (fixed version not stated in the sources).

## Timeline

- 2026-11-03T05:48:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120563

## From the sources

The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the save_currency() AJAX handler, which lacks capability checks and allows subscriber-level users to store malicious SQL payloads that are later concatenated directly into ORDER BY clauses without proper sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries to extract sensitive information from the database.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_