Wpml Multilingual Multicurrency For Woocommerce
Monthly
SQL injection in WooCommerce Multilingual & Multicurrency with WPML up to and including 5.5.7 lets an authenticated attacker with Shop Manager-level access or above store a crafted currency exchange-rate value that is later concatenated into an ORDER BY clause, allowing additional SQL queries to read sensitive database contents. The weakness is confidentiality-only and requires the plugin to be active with multicurrency configured; no public exploit or CISA KEV entry was identified at time of analysis. CVSS 4.9 reflects the high privilege prerequisite rather than low real-world exposure.
SQL injection in WooCommerce Multilingual & Multicurrency with WPML up to and including 5.5.7 lets an authenticated attacker with Shop Manager-level access or above store a crafted currency exchange-rate value that is later concatenated into an ORDER BY clause, allowing additional SQL queries to read sensitive database contents. The weakness is confidentiality-only and requires the plugin to be active with multicurrency configured; no public exploit or CISA KEV entry was identified at time of analysis. CVSS 4.9 reflects the high privilege prerequisite rather than low real-world exposure.