Germanized For Woocommerce
Monthly
An authorization workflow gap in the Germanized for WooCommerce plugin for WordPress, versions up to and including 4.1.4, lets an authenticated attacker with Subscriber-level access change their account email to a victim's billing email and then redeem their original, unrotated activation token, causing a pre-existing guest order to be linked to the attacker's account and exposing the buyer's billing name, street address, phone number and purchased items on the attacker's My Account page. Exploitation is conditional: the site must run double opt-in with 'Disable login for unactivated customers' explicitly set to No (non-default), public customer registration must be enabled, the token must be redeemed within its one-day expiry window, and a guest order must already exist whose billing email matches the victim address used. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the stacked configuration and timing prerequisites substantially limit real-world exploitability despite the network attack vector and low attack complexity.
Unauthenticated attackers can execute arbitrary WordPress shortcodes in the Germanized for WooCommerce plugin (all versions up to 3.20.5) via the 'account_holder' parameter, which bypasses shortcode validation in the do_shortcode() function. This enables remote code execution with medium severity (CVSS 6.5) affecting any WordPress site with the vulnerable plugin installed. No public exploit code or active exploitation has been confirmed at the time of analysis.
An authorization workflow gap in the Germanized for WooCommerce plugin for WordPress, versions up to and including 4.1.4, lets an authenticated attacker with Subscriber-level access change their account email to a victim's billing email and then redeem their original, unrotated activation token, causing a pre-existing guest order to be linked to the attacker's account and exposing the buyer's billing name, street address, phone number and purchased items on the attacker's My Account page. Exploitation is conditional: the site must run double opt-in with 'Disable login for unactivated customers' explicitly set to No (non-default), public customer registration must be enabled, the token must be redeemed within its one-day expiry window, and a guest order must already exist whose billing email matches the victim address used. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the stacked configuration and timing prerequisites substantially limit real-world exploitability despite the network attack vector and low attack complexity.
Unauthenticated attackers can execute arbitrary WordPress shortcodes in the Germanized for WooCommerce plugin (all versions up to 3.20.5) via the 'account_holder' parameter, which bypasses shortcode validation in the do_shortcode() function. This enables remote code execution with medium severity (CVSS 6.5) affecting any WordPress site with the vulnerable plugin installed. No public exploit code or active exploitation has been confirmed at the time of analysis.