CVE-2025-60114

MediumCVSS 6.6

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

The YayCurrency plugin for WordPress (versions up to and including 3.3.1) contains a Code Injection vulnerability caused by improper control of code generation. An attacker can inject and execute arbitrary code within the application context.

Risk Assessment

Exploitation can lead to full compromise of the WordPress site, data theft, backdoor installation, or content modification. The risk is high because the plugin runs in the web server context.

Recommendation

Update YayCurrency to a version newer than 3.3.1 or disable it if no update is available. Additionally, review server logs for unusual requests and executed PHP files.

Other vulnerabilities in YayCurrency

CVE-2026-16058Medium
The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers.

Original NVD description (English source)

Improper Control of Generation of Code ('Code Injection') vulnerability in YayCommerce YayCurrency yaycurrency allows Code Injection.This issue affects YayCurrency: from n/a through <= 3.3.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS