PT-2025-39561 · Yaycommerce · Yaycurrency

Nabil Irawan · Published 2025-09-26 · Updated 2025-09-26 · CVE-2025-60114

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions YayCommerce YayCurrency versions through 3.2

Description A code injection issue exists in YayCommerce YayCurrency. The flaw is due to improper control of code generation. Successful exploitation could allow attackers to inject and execute arbitrary code.

Recommendations Update YayCommerce YayCurrency to a version later than 3.2.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-60114

Affected Products

Yaycurrency

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-60114 · Security Note
• https://patchstack.com/database/wordpress/plugin/yaycurrency/vulnerability/wordpress-yaycurrency-plugin-3-2-remote-code-execution-rce-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/yaycurrency/vulnerability/wordpress-yaycurrency-plugin-3-2-remote-code-execution-rce-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1971499223553360354 · Twitter Post