ByteOS Network

CVE Vulnerability Details :

CVE-2026-11778

PUBLISHED

More Info Official Page

Assigner-Wordfence

Assigner Org ID-b15e7b5b-3da4-40ae-a43c-f7aa60e62599

Published At-03 Jul, 2026 | 07:53

Updated At-03 Jul, 2026 | 07:53

▼CVE Numbering Authority (CNA)

CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter

The The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.2.14. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Affected Products

Vendor

VillaTheme

Product

CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x

Default Status

unaffected

Versions

Affected

From 0 through 2.2.14 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-94	CWE-94 Improper Control of Generation of Code ('Code Injection')

Type: CWE

CWE ID: CWE-94

Description: CWE-94 Improper Control of Generation of Code ('Code Injection')

Metrics

Version	Base score	Base severity	Vector
3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Credits

finder

sterva

Timeline

Event	Date
Vendor Notified	2026-06-09 12:30:38
Disclosed	2026-07-02 00:00:00

Event: Vendor Notified

Date: 2026-06-09 12:30:38

Event: Disclosed

Date: 2026-07-02 00:00:00

References

Hyperlink	Resource
https://www.wordfence.com/threat-intel/vulnerabilities/id/5a30e5dc-1f15-40ce-9703-1e1add1df6da?source=cve	N/A
https://plugins.trac.wordpress.org/browser/woo-multi-currency/trunk/frontend/cache.php#L108	N/A
https://plugins.trac.wordpress.org/browser/woo-multi-currency/trunk/frontend/cache.php#L99	N/A
https://plugins.trac.wordpress.org/browser/woo-multi-currency/trunk/frontend/cache.php#L18	N/A