CVE-2024-13487: CURCY – Multi Currency for WooCommerce <= 2.2.5 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Function
The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution via the getproductsprice() function in all versions up to, and including, 2.2.5. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13487?
CVE-2024-13487 is classified as a high severity vulnerability due to the risk of arbitrary shortcode execution.
How do I fix CVE-2024-13487?
To fix CVE-2024-13487, update the CURCY Multi Currency for WooCommerce plugin to version 2.2.6 or later.
What versions are affected by CVE-2024-13487?
CVE-2024-13487 affects all versions of the CURCY Multi Currency for WooCommerce plugin up to and including 2.2.5.
What is the impact of CVE-2024-13487 on my WooCommerce site?
The impact of CVE-2024-13487 on your WooCommerce site includes potential unauthorized execution of code via shortcodes.
Is the CURCY Multi Currency for WooCommerce plugin compatible with WooCommerce 9.x?
Yes, the CURCY Multi Currency for WooCommerce plugin is compatible with WooCommerce 9.x but prior versions are vulnerable to CVE-2024-13487.