Germanized For Woocommerce CVE-2026-2582

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates a network-accessible, low-complexity attack requiring no privileges or user interaction, resulting in confidentiality and integrity impact without availability loss. The 6.5 base score reflects moderate-to-high real-world risk for affected sites. However, actual exploitation impact depends on which shortcodes are registered in the WordPress environment-if only benign shortcodes exist, the practical impact may be limited; if dangerous ones are present (e.g., admin-only shortcodes from premium plugins), attackers can escalate to full RCE. The unauthenticated attack vector significantly raises risk for publicly accessible WordPress installations. No EPSS, KEV status, or POC availability data provided, but the combination of trivial access vector and trivial complexity suggests this is a genuine priority for vulnerability management, not a CVSS-inflation case.

An attacker crafts a malicious POST request to the WooCommerce direct-debit payment processing endpoint with the 'account_holder' parameter containing a shortcode payload such as [malicious_shortcode] or a chain of shortcodes targeting known plugins. The request bypasses authentication (PR:N) and reaches the vulnerable code path, where do_shortcode() processes the unsanitized input and executes the embedded shortcode. Depending on available shortcodes in the environment, this could leak sensitive information, modify site content, or escalate to remote code execution if a plugin provides a shortcode with PHP execution capabilities.