CVE-2026-97071: WordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability

Q: Who can exploit this vulnerability?

The listed CVSS vector indicates that exploitation is network-accessible and requires neither authentication nor user interaction. An unauthenticated remote attacker could potentially target an affected CURCY installation.

Q: What is the impact if exploitation succeeds?

The vulnerability is rated medium severity with a 5.3 CVSS score. The stated impact is limited to integrity; no confidentiality or availability impact is listed.

Q: Which versions are affected?

CURCY woo-multi-currency versions through 2.2.17 are affected. The provided information does not identify a fixed version.

Published Oct 5, 2026

Updated

Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17.

Affected Software

1 affected component

Villatheme CURCY woo-multi-currency<=2.2.17

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress CURCY plugin to a version that resolves this vulnerability.
Fixed in 2.2.18

Event History

Oct 5, 2026

CVE Published

via MITRE·08:40 AM

Data Sourced

via MITRE·08:40 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

The listed CVSS vector indicates that exploitation is network-accessible and requires neither authentication nor user interaction. An unauthenticated remote attacker could potentially target an affected CURCY installation.

What is the impact if exploitation succeeds?