What is the CVSS score of CVE-2026-2582?

CVE-2026-2582 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2026-2582

EUVD-2026-22223 MEDIUM

Code Injection (CWE-94)

2026-04-14 Wordfence

Code Injection RCE WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 07:25 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 07:15 euvd

EUVD-2026-22223

Analysis Generated

Apr 14, 2026 - 07:15 vuln.today

CVE Published

Apr 14, 2026 - 06:43 nvd

MEDIUM 6.5

DescriptionCVE.org

The The Germanized for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution via 'account_holder' parameter in all versions up to, and including, 3.20.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

AnalysisAI

Unauthenticated attackers can execute arbitrary WordPress shortcodes in the Germanized for WooCommerce plugin (all versions up to 3.20.5) via the 'account_holder' parameter, which bypasses shortcode validation in the do_shortcode() function. This enables remote code execution with medium severity (CVSS 6.5) affecting any WordPress site with the vulnerable plugin installed. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability stems from CWE-94 (Improper Control of Generation of Code via Code Injection) in the direct-debit gateway payment processing code. The plugin accepts the 'account_holder' parameter and passes it directly to WordPress's do_shortcode() function without validating or sanitizing the input first. WordPress shortcodes provide a powerful templating mechanism-any registered shortcode can be invoked by an attacker, potentially including shortcodes provided by other plugins or themes that may execute PHP code or access sensitive data. The flaw exists in the gateway handler class at the referenced plugin path, where the parameter flows from user input to the shortcode processor without intermediate validation controls.

RemediationAI

Update the Germanized for WooCommerce plugin to version 3.20.6 or later, which implements proper input validation and sanitization on the 'account_holder' parameter before shortcode execution. Site administrators should navigate to WordPress Dashboard → Plugins → Installed Plugins, locate Germanized for WooCommerce, and apply the update immediately. If a patched version is not yet available in the update feed, temporarily disable the direct-debit payment gateway in WooCommerce settings to prevent exploitation. Consult the Wordfence advisory at the provided URL for additional security context and confirmation of patch availability.