What is the CVSS score of CVE-2026-11778?

CVE-2026-11778 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

CURCY Multi Currency CVE-2026-11778

EUVD-2026-41521 MEDIUM

Code Injection (CWE-94)

2026-07-03 Wordfence

GHSA-j638-4r9q-m7mm

WordPress RCE Code Injection Wordpress Plugin Curcy Multi Currency For Woocommerce Smoothly On Woocommerce 9 X Villatheme

5.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Wordfence's direct code review confirms unauthenticated access, overriding NVD's PR:L; scope unchanged as impact is limited to shortcode output within WordPress.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 09:15 vuln.today

CVE Published

Jul 03, 2026 - 07:53 cve.org

MEDIUM 5.4

DescriptionCVE.org

The The CURCY - Multi Currency for WooCommerce - Smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.2.14. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

AnalysisAI

Arbitrary shortcode execution in the CURCY Multi Currency for WooCommerce WordPress plugin (versions up to and including 2.2.14) allows unauthenticated attackers to invoke any registered WordPress shortcode by sending a crafted request to a vulnerable action handler in frontend/cache.php. The root cause is a failure to validate the shortcode value before passing it to do_shortcode(), meaning any shortcode registered on the site - including those that expose user data, perform database queries, or render sensitive page content - can be triggered without authentication. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, though the low attack complexity and zero-authentication requirement elevate practical risk above what the moderate CVSS score suggests.

Technical ContextAI

The vulnerability resides in the CURCY - Multi Currency for WooCommerce plugin by VillaTheme, identified via CPE cpe:2.3:a:villatheme:curcy_-_multi_currency_for_woocommerce_-_smoothly_on_woocommerce_9.x. The affected code is in frontend/cache.php at approximately lines 18, 99, and 108, where the plugin registers a WordPress AJAX or front-end action that accepts a user-supplied parameter and passes it directly to WordPress's do_shortcode() function without sanitization or allowlist validation. CWE-94 (Improper Control of Generation of Code) classifies this class of flaw: the application treats attacker-supplied data as executable code by allowing it to name which shortcode to run. In WordPress, shortcodes are registered by themes and plugins and can perform a wide range of operations - from rendering content to querying databases - making uncontrolled shortcode execution a meaningful code injection primitive even without direct PHP execution.

RemediationAI

Update the CURCY - Multi Currency for WooCommerce plugin to a version beyond 2.2.14 once a patched release is published by VillaTheme - no confirmed fixed version is independently available at time of analysis, so monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5a30e5dc-1f15-40ce-9703-1e1add1df6da for release confirmation. As an interim compensating control, site administrators can use a Web Application Firewall (such as Wordfence's own firewall) to block requests that include shortcode-like payloads to the vulnerable AJAX endpoint identified in frontend/cache.php. Disabling the plugin entirely eliminates the attack surface with the trade-off of losing multi-currency functionality. Restricting the vulnerable action to authenticated users via WordPress action hooks is a code-level workaround that requires custom development. Review registered shortcodes on the affected site to understand the realistic blast radius - sites with shortcodes exposing sensitive data should treat this as higher priority.