CVE-2024-13487: CURCY – Multi Currency for WooCommerce <= 2.2.5 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Function
First published: Thu Feb 06 2025(Updated: )
The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution via the get_products_price() function in all versions up to, and including, 2.2.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CURCY Multi Currency for WooCommerce | <=2.2.5 | |
| WooCommerce | <=9.x |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d630dd85-0169-4582-a8ae-54e5053425ac?source=cve
- https://plugins.trac.wordpress.org/browser/woo-multi-currency/trunk/frontend/cache.php#L60
- https://wordpress.org/plugins/woo-multi-currency/#developers
- https://plugins.trac.wordpress.org/changeset/3234505/
Frequently Asked Questions
What is the severity of CVE-2024-13487?
CVE-2024-13487 is classified as a high severity vulnerability due to the risk of arbitrary shortcode execution.
How do I fix CVE-2024-13487?
To fix CVE-2024-13487, update the CURCY Multi Currency for WooCommerce plugin to version 2.2.6 or later.
What versions are affected by CVE-2024-13487?
CVE-2024-13487 affects all versions of the CURCY Multi Currency for WooCommerce plugin up to and including 2.2.5.
What is the impact of CVE-2024-13487 on my WooCommerce site?
The impact of CVE-2024-13487 on your WooCommerce site includes potential unauthorized execution of code via shortcodes.
Is the CURCY Multi Currency for WooCommerce plugin compatible with WooCommerce 9.x?
Yes, the CURCY Multi Currency for WooCommerce plugin is compatible with WooCommerce 9.x but prior versions are vulnerable to CVE-2024-13487.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/source
- agent/severity
- agent/last-modified-date
- agent/type
- agent/first-publish-date
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/curcy
- canonical/curcy multi currency for woocommerce
- vendor/woocommerce
- canonical/woocommerce