CVE-2026-11778: CURCY WooCommerce Plugin Arbitrary Shortcode Execution Vulnerability

Technical summary

CVE-2026-11778 is an arbitrary shortcode execution vulnerability in the CURCY WooCommerce plugin stemming from insufficient input validation (CWE-94: Improper Control of Generation of Code). The plugin processes user input through the do_shortcode() function without first validating or sanitizing the supplied values. Because the vulnerable action accepts unauthenticated requests, an attacker can craft a malicious request to inject and execute arbitrary shortcodes, potentially leading to data exposure, store manipulation, or further compromise. The CVSS 3.1 score of 5.4 reflects a network-accessible attack with low complexity that requires only limited privileges, resulting in low confidentiality and integrity impact.

Business impact

For WooCommerce store operators, this vulnerability represents a direct threat to store functionality and customer data. Malicious shortcode execution could expose sensitive information (customer lists, pricing, payment data), modify product listings or pricing without authorization, inject spam or phishing content into the storefront, or establish persistence for further attacks. The risk is heightened because the plugin handles multi-currency transactions, making it a logical target. Store owners using this plugin should consider this a priority remediation item to prevent unauthorized modification of their commerce platform.

Affected systems

The CURCY – Multi Currency for WooCommerce plugin in all versions up to and including 2.2.14 is vulnerable. Any WordPress installation with this plugin active and accessible over the network is at risk. The vulnerability does not require the attacker to have an authenticated account, making every exposed instance a potential target. Site administrators should verify their installed version immediately; the vendor advisory will specify which patch version resolves this issue.

Exploitability

Exploitation is straightforward: the attack vector is network-based with low complexity, meaning an attacker can craft and send a malicious HTTP request without special tools or conditions. Although the CVSS vector requires low privilege (PR:L), the vulnerability is effectively unauthenticated from a practical standpoint for the purposes of triggering shortcode execution on a vulnerable action. No user interaction is required. The lack of CISA KEV status does not diminish the threat; it reflects that active exploitation in the wild has not yet been formally confirmed or widely reported.

Remediation

Update the CURCY plugin to a patched version that implements proper input validation before invoking do_shortcode(). Verify the specific patch version against the vendor's advisory, as the ground-truth data does not specify which version number resolves the issue. In the interim, consider disabling the plugin if it is not critical to operations, or restrict access to the plugin's vulnerable endpoints via firewall rules or Web Application Firewall (WAF) rules if the attack surface can be limited.

Patch guidance

Contact the CURCY plugin maintainers or check WordPress.org's plugin repository for the latest release notes. The vulnerability was published on 2026-07-03 and modified on 2026-07-06, suggesting a fix may already be available. Apply the patch immediately after verifying it resolves CVE-2026-11778 and test thoroughly in a staging environment to ensure no WooCommerce functionality is disrupted. Monitor the vendor advisory for any additional guidance on input validation improvements.

Detection guidance

Monitor server logs and WAF logs for requests containing suspicious shortcode patterns (e.g., '[' and ']' characters) sent to the CURCY plugin's action endpoints. Implement logging of all do_shortcode() calls in your WordPress environment to detect unexpected shortcode execution. Use WordPress security plugins (e.g., Wordfence, Sucuri) to audit plugin behavior and flag suspicious shortcode usage. Consider setting up alerts for any changes to plugin files or database entries associated with CURCY after patching to detect post-exploitation persistence.

Why prioritize this

Although the CVSS score of 5.4 is rated MEDIUM, the combination of network accessibility, low attack complexity, and lack of authentication requirements makes this a pragmatic priority for any organization running this plugin. The integrity and confidentiality impact could affect customer trust and compliance posture. Organizations should prioritize patching within 1–2 weeks, especially if the plugin handles payment or sensitive customer data. The absence of KEV status does not reduce urgency; it may simply indicate a lag in public disclosure or exploitation tracking.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects a network-accessible vulnerability with low attack complexity and low privilege requirements, yielding low confidentiality and integrity impact but no availability impact. The lack of user interaction required and the unauthenticated nature of exploitation push this into the upper range of MEDIUM severity. For organizations running WooCommerce with this plugin, the business context (ecommerce, customer data, transaction processing) may warrant treating this as a higher operational priority than the base CVSS score alone suggests.

Frequently asked questions