VillaTheme CURCY EUVD-2026-92310

Exploitation requires a reachable WordPress site running the VillaTheme CURCY (woo-multi-currency) plugin at any version from the initial release through 2.2.17; the affected component is the plugin's currency conversion/calculation logic (CWE-682 incorrect calculation). Per the supplied CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no special configuration are stated to be required for a remote attacker. The practical limiting factors are that the site must have this specific plugin installed and active, and that the real impact is a single low-severity outcome (either limited data disclosure or limited data manipulation, pending clarification of the conflicting impact signals) rather than code execution or full compromise.

This is a moderate-severity (CVSS 5.3) issue in the VillaTheme CURCY (woo-multi-currency) WordPress plugin, and the available signals point to a low real-world priority rather than an urgent threat. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-based, low-complexity, unauthenticated attack with no user interaction, which sounds broadly exploitable, but the impact is limited to a single low-severity dimension and scope is unchanged. No EPSS score, SSVC decision, or KEV listing was provided, and there is no POC indication, so there is no evidence of active or automated exploitation. There is a notable conflict in the impact signals that must be verified: the input CVSS vector encodes C:N/I:L (a low INTEGRITY impact, no confidentiality), yet the Patchstack reference title describes this as a 'broken access control vulnerability' and the tags label it 'Information Disclosure' - which would imply a CONFIDENTIALITY (C:L) impact instead. These two framings are inconsistent; defenders should confirm with Patchstack/vendor whether the realistic outcome is data disclosure or data tampering via miscalculated currency values. Overall: a high-reach-but-low-impact flaw that merits routine patching, not emergency response.

A remote, unauthenticated attacker sends crafted requests to a WooCommerce store running CURCY, abusing an unprotected currency/calculation endpoint (CWE-682, 'Integer Attacks') to either read data that should be access-controlled or skew currency conversion values. No exploit code was identified at the time of analysis, and the low-complexity network vector means no special timing or privileges are required if the vulnerable endpoint is reachable.