CVE-2026-62130

HighCVSS 7.2

Published: 10/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

21th percentile - higher than 21% of all known CVEs

Summary

The WooCommerce Multilingual & Multicurrency plugin in versions up to and including 5.5.8 contains a PHP Object Injection flaw exploitable by a shop manager user. This may lead to dangerous code execution or further privilege escalation.

Risk Assessment

A user with shop manager privileges can exploit the flaw to inject PHP objects, risking site takeover or data leakage.

Recommendation

Update the WooCommerce Multilingual & Multicurrency plugin to a version newer than 5.5.8 and review shop manager account permissions.

Other vulnerabilities in WooCommerce Multilingual & Multicurrency

CVE-2026-66711High
Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.

Original NVD description (English source)

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS