WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Currency Exchange Rate
- ID
- WPSEC-2026-0230
- Plugin
- WPML Multilingual & Multicurrency for WooCommerce (woocommerce-multilingual)
- Affected
- from 5.5.1 before 5.5.8
- Remediation
- Update to 5.5.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- WPML Multilingual & Multicurrency for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence, on 2026-09-30.
Description
The WPML Multilingual & Multicurrency for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the currency exchange rate in versions 5.5.1 up to, and including, 5.5.7 due to insufficient validation of the exchange rate saved through the multi-currency settings and the lack of sufficient preparation when that rate is placed into the price-sorting SQL query. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL to queries executed when the shop is sorted by price in a secondary currency, which can be used to extract sensitive information from the database.
References
- https://wpsec.com/vuln/WPSEC-2026-0230/
- https://plugins.svn.wordpress.org/woocommerce-multilingual/tags/5.5.8/
- https://wordpress.org/plugins/woocommerce-multilingual/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS