PT-2025-5801 · Woocommerce · Curcy – Multi Currency For Woocommerce

Michael Mazzolini + 1 · Published 2025-02-06 · Updated 2025-02-06 · CVE-2024-13487

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions The CURCY – Multi Currency for WooCommerce versions up to, and including, 2.2.5

Description The issue allows unauthenticated attackers to execute arbitrary shortcodes due to the software not properly validating a value before running do shortcode(). This is possible through the get products price() function. Unauthenticated users can execute arbitrary shortcodes into the popular free currency exchange plugin.

Recommendations As a temporary workaround, consider disabling the get products price() function until a patch is available. Restrict access to the do shortcode() function to minimize the risk of exploitation. Avoid using the get products price() function in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-13487

Affected Products

Curcy – Multi Currency For Woocommerce

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-13487 · Security Note
• https://twitter.com/CVEnew/status/1887399291896861021 · Twitter Post
• https://wordpress.org/plugins/woo-multi-currency/#developers · Note
• https://twitter.com/Netlas_io/status/1887412975494889810 · Twitter Post
• https://t.me/cvenotify/110208 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3234505 · Note
• https://t.me/cvedetector/17370 · Telegram Post
• https://t.me/netlas/334 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d630dd85-0169-4582-a8ae-54e5053425ac?source=cve · Note
• https://plugins.trac.wordpress.org/browser/woo-multi-currency/trunk/frontend/cache.php#L60 · Note