EUVD-2026-22223Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The The Germanized for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution via 'account_holder' parameter in all versions up to, and including, 3.20.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
AnalysisAI
Unauthenticated attackers can execute arbitrary WordPress shortcodes in the Germanized for WooCommerce plugin (all versions up to 3.20.5) via the 'account_holder' parameter, which bypasses shortcode validation in the do_shortcode() function. This enables remote code execution with medium severity (CVSS 6.5) affecting any WordPress site with the vulnerable plugin installed. No public exploit code or active exploitation has been confirmed at the time of analysis.
Technical ContextAI
The vulnerability stems from CWE-94 (Improper Control of Generation of Code via Code Injection) in the direct-debit gateway payment processing code. The plugin accepts the 'account_holder' parameter and passes it directly to WordPress's do_shortcode() function without validating or sanitizing the input first. WordPress shortcodes provide a powerful templating mechanism-any registered shortcode can be invoked by an attacker, potentially including shortcodes provided by other plugins or themes that may execute PHP code or access sensitive data. The flaw exists in the gateway handler class at the referenced plugin path, where the parameter flows from user input to the shortcode processor without intermediate validation controls.
RemediationAI
Update the Germanized for WooCommerce plugin to version 3.20.6 or later, which implements proper input validation and sanitization on the 'account_holder' parameter before shortcode execution. Site administrators should navigate to WordPress Dashboard → Plugins → Installed Plugins, locate Germanized for WooCommerce, and apply the update immediately. If a patched version is not yet available in the update feed, temporarily disable the direct-debit payment gateway in WooCommerce settings to prevent exploitation. Consult the Wordfence advisory at the provided URL for additional security context and confirmation of patch availability.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today