CVE-2026-120563 in WooCommerce Multilingual & Multicurrency with WPML Plugin
Summary
by MITRE • 11/03/2026
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the save_currency() AJAX handler, which lacks capability checks and allows subscriber-level users to store malicious SQL payloads that are later concatenated directly into ORDER BY clauses without proper sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries to extract sensitive information from the database.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The WooCommerce Multilingual & Multicurrency plugin, which integrates deeply with WPML to facilitate global e-commerce operations on WordPress sites, contains a critical security flaw in versions up through 5.5.7 that exposes backend data integrity and confidentiality to compromise. This vulnerability stems from an insufficient input validation mechanism within the save_currency AJAX handler, specifically targeting the currency exchange rate parameter used for updating pricing structures across different regions. The core technical failure lies in the application's handling of user-supplied data during administrative operations where financial configurations are modified. Instead of enforcing strict type checking or sanitization protocols on the numeric values representing exchange rates, the software directly incorporates these inputs into SQL query construction without adequate escaping mechanisms. This oversight creates a classic injection vector that allows malicious actors to manipulate database queries by injecting arbitrary SQL code through seemingly legitimate configuration fields.
The severity of this flaw is significantly amplified by its low privilege requirement and broad impact scope. While many WordPress vulnerabilities require administrator-level access, this specific issue can be exploited by authenticated users with Shop Manager-level permissions or higher. In typical WooCommerce setups, shop managers are responsible for managing products, orders, and sometimes currency settings but do not necessarily have full administrative control over the entire site infrastructure. This discrepancy between permission level and attack capability means that a compromised account of an employee or partner with limited access can be leveraged to execute complex SQL operations against the underlying database. The attacker does not need to bypass authentication mechanisms; they simply utilize their existing, albeit restricted, credentials to trigger the vulnerable code path via standard AJAX requests generated by the plugin's interface.
The operational impact of this vulnerability centers on the potential for unauthorized data extraction and manipulation through blind or error-based SQL injection techniques. Because the malicious payload is concatenated directly into ORDER BY clauses within database queries, attackers can construct sophisticated statements that extract sensitive information such as user credentials, payment details, customer personal identifiable information, and other proprietary business data stored in the WordPress database. The ability to append additional SQL queries means an attacker could potentially dump entire tables or modify critical configuration settings if the underlying database permissions allow for write operations beyond simple selection. This poses a severe risk to businesses relying on this plugin, as it undermines trust in payment processing systems and exposes customer data to regulatory violations under frameworks like GDPR or CCPA due to inadequate access controls and input sanitization practices.
From an industry standards perspective, this vulnerability aligns with CWE-89, which defines Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The specific context involves the use of user-supplied data in a dynamic query construction without proper encoding or parameterization. Furthermore, from a tactical standpoint related to the MITRE ATT&CK framework, this exploit falls under T1059, specifically command and script interpretation variants that allow for database interaction, often categorized within lateral movement or credential access phases depending on how the extracted data is utilized by the attacker. The lack of capability checks in the AJAX handler represents a failure in implementing proper authorization controls, which also touches upon CWE-284 regarding Improper Access Control, although the primary vector remains input validation failure leading to code injection.
To mitigate this risk and secure WordPress environments utilizing affected versions of WooCommerce Multilingual & Multicurrency with WPML, immediate action is required at both the application and infrastructure levels. The most effective remediation strategy involves upgrading the plugin to version 5.5.8 or later, where developers have implemented stricter input validation and sanitization routines for all currency-related parameters before they are processed by database queries. Organizations should also enforce principle of least privilege within their WordPress installations, ensuring that shop managers do not possess unnecessary permissions related to global site configuration unless absolutely required. Additionally, implementing a Web Application Firewall can provide an additional layer of defense by detecting and blocking anomalous SQL patterns in AJAX requests, although this serves only as a compensating control rather than a fix for the underlying code defect. Regular security audits and penetration testing focused on administrative interfaces are recommended to identify similar vulnerabilities across other plugins that handle sensitive financial data with insufficient input validation protocols.