WooCommerce Multilingual CVE-2026-120563

Requires the WooCommerce Multilingual & Multicurrency with WPML plugin (version ≤5.5.7) installed and active with multicurrency configured, plus an authenticated account. The save_currency() AJAX handler performs no capability check, so the malicious exchange-rate value can be stored; however, per the description the data-extraction step via the ORDER BY clause requires Shop Manager-level access or above (CVSS PR:H). Limiting factors: exploitation depends on an authenticated elevated (Shop Manager+) store role, the plugin being present with multicurrency in use, and a vulnerable version; it is confidentiality-only and does not modify or disrupt data (I:N/A:N). The internal subscriber-vs-Shop-Manager discrepancy in the source should be confirmed with the vendor before relaxing the privilege assumption.

This is a medium-severity (CVSS 4.9) SQL injection whose real-world priority is tempered primarily by the privilege requirement. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) scores network reach and low complexity but PR:H, meaning the confidentiality-impacting exploitation requires an already-elevated Shop Manager-or-above account. There is an explicit internal conflict in the source data: the description states the save_currency() AJAX handler 'lacks capability checks and allows subscriber-level users to store malicious SQL payloads' (which would imply low privilege for the storage step), yet also states that extracting data requires 'Shop Manager-level access and above,' and the CVSS encodes PR:H - verify with Wordfence whether the practical attack is low-privilege stored injection or high-privilege direct extraction. No EPSS score, no KEV listing, and no confirmed public exploit were provided, and the vuln.today decision label is 'this_month' rather than act_now/emergency - together these signals point to a real but non-urgent, privilege-gated data-disclosure issue rather than a mass-exploitation priority. Impact is confidentiality-only (I:N/A:N), consistent with read-oriented data extraction via ORDER BY.

An attacker holding a Shop Manager-level (or higher) account on a WooCommerce store running WPML Multicurrency reaches the unprotected save_currency() AJAX handler and submits a crafted currency exchange rate value containing SQL. The stored value is later concatenated into an ORDER BY clause without sanitization, letting the attacker append queries to read sensitive database contents such as user or order data. No public exploit was identified at time of analysis, and the attack is limited to actors who already possess elevated store privileges.