CVE-2026-120563— WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field
Quick assessment
Affected
amirhelzer WPML Multilingual & Multicurrency for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的"WooCommerce 多语言与多货币（配合 WPML）”插件在所有 5.5.7 及更早版本中均存在 SQL 注入漏洞。该漏洞源于 AJAX 处理程序中对货币汇率参数缺乏足够的输入验证：该处理程序未执行能力检查，允许订阅者（subscriber）级别的攻击者存储恶意的 SQL 载荷，而这些载荷随后会被直接拼接到 ORDER BY 子句中，且未经过适当的清理。这使得拥有“商店管理员”（Shop Manager）及以上权限的已认证攻击者能够追加额外的 SQL 查询，从而从数据库中窃取敏感信息。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-120563
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field
Source: CVE Program / CVE List V5
Vulnerability Description
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the save_currency() AJAX handler, which lacks capability checks and allows subscriber-level users to store malicious SQL payloads that are later concatenated directly into ORDER BY clauses without proper sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries to extract sensitive information from the database.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| amirhelzer | WPML Multilingual & Multicurrency for WooCommerce | 0 ~ 5.5.7 | - |
|
II. Public POCs for CVE-2026-120563
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-120563
请登录查看更多情报信息。
Other References for CVE-2026-120563 (8)
IV. Related Vulnerabilities
Same weakness: CWE-89
-
CVE-2026-120558
Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenti -
CVE-2026-120065
psqlODBC does not escape a server-supplied column name in it -
CVE-2026-120062
psqlODBC SQL injection through SQLSpecialColumns table and s -
CVE-2026-105604
Joomla Extension - dj-extensions.com - Unauthenticated SQL i -
CVE-2026-77881
Control Web Panel (CWP) < 1.30 Blind SQL Injection via user