WordPress Plugin Vulnerabilities

CURCY < 2.2.15 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter

Description

The The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.2.14. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Affects Plugins

Plugin icon
woo-multi-currency
Fixed in 2.2.15

References

CVE
CVE-2026-11778
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5a30e5dc-1f15-40ce-9703-1e1add1df6da

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
6.5 (Medium)

Miscellaneous

Original Researcher
sterva
Verified
No
WPVDB ID
fa4a397a-4cfb-4a0d-8350-2acc54b0d30c

Timeline

Publicly Published
2026-07-02 (about 1 month ago)
Added
2026-07-02 (about 1 month ago)
Last Updated
2026-07-03 (about 1 month ago)

Other

Published
Title
Published
2026-03-30
Title
Everest Forms Pro < 1.9.13 - Unauthenticated Remote Code Execution via Calculation Field
Published
2025-04-03
Title
TagDiv Composer < 5.4 - Unauthenticated Arbitrary PHP Object Instantiation
Published
2025-07-21
Title
Nginx Cache Purge Preload < 2.1.3 - Authenticated (Administrator+) Remote Code Execution
Published
2026-06-17
Title
Advanced Ads – Ad Manager & AdSense < 2.0.22 - Contributor+ Remote Code Execution
Published
2023-11-07
Title
Rename Media Files <= 1.0.1 - Authenticated (Contributor+) Remote Code Execution