SQL Injection Vulnerability in WooCommerce Multilingual & Multicurrency Plugin by WPML

CVE-2026-120563

What is CVE-2026-120563?

The WooCommerce Multilingual & Multicurrency plugin for WordPress is prone to SQL Injection, which arises from inadequate input validation on the currency exchange rate parameter in the save_currency() AJAX handler. This deficiency signifies that subscriber-level users can introduce malicious SQL payloads into ORDER BY clauses without proper sanitization. Consequently, authenticated users with Shop Manager-level access and above may exploit this vulnerability to execute arbitrary SQL queries, potentially exposing sensitive information stored in the database.

References