CURCY Multi Currency CVE-2026-11778

The site must be running WordPress with WooCommerce and the CURCY - Multi Currency for WooCommerce plugin installed and active in version 2.2.14 or earlier. No authentication is required per the Wordfence advisory, meaning the vulnerable action is accessible to any remote party who can send HTTP requests to the WordPress site - this contradicts the PR:L designation in the NVD CVSS vector, which should be verified against vendor confirmation. The practical impact is bounded by which shortcodes are registered on the target installation: a shortcode that outputs only static HTML provides minimal value to an attacker, while one that renders account data, pricing rules, or protected content substantially increases the risk. There is no reported requirement for a specific server configuration, non-default WordPress setting, or particular PHP version beyond the plugin being active.

The official NVD CVSS score of 5.4 (Medium) uses PR:L, implying low-privilege authentication is required, but the Wordfence description explicitly states 'unauthenticated attackers' can exploit this - a direct conflict that significantly affects real-world risk assessment. If the unauthenticated claim from Wordfence (the reporting researcher with direct code access) is accurate, the effective attack complexity is AV:N/AC:L/PR:N, which would correspond to a higher exploitability score. EPSS data is not provided, but the zero-barrier entry point on a publicly-accessible WordPress e-commerce site, combined with low attack complexity, makes this opportunistically exploitable at scale if automated. No active exploitation is confirmed (not in CISA KEV) and no POC is publicly known at time of analysis. Real-world impact is bounded by what shortcodes the target site has registered - sites with shortcodes exposing PII, order data, or admin-only content face higher impact than those with only basic display shortcodes. SSVC framing: exploitation is not yet confirmed, the attack is automatable, and technical impact is partial - placing this in a 'track and patch promptly' tier rather than emergency response.

An unauthenticated attacker sends a crafted HTTP POST request to the WordPress AJAX endpoint, supplying a shortcode name (such as one registered by a membership or e-commerce plugin) as the unsanitized parameter in the CURCY plugin's cache action. The plugin passes the value directly to do_shortcode(), which executes the named shortcode and returns its output to the attacker - potentially exposing order details, user data, or other content that the shortcode would normally render in an authenticated or protected context. No public POC is known, but the attack requires only knowledge of the endpoint and a valid shortcode name, both of which are discoverable by inspecting plugin source code.