The CURCY – Multi Currency for WooCommerce plugin, widely used to provide currency exchange functionality on WooCommerce-based WordPress sites, contains a critical vulnerability identified as CVE-2024-13487. The flaw arises from improper control of code generation (CWE-94) within the get_products_price() function, which fails to validate input before invoking WordPress's do_shortcode function. This allows unauthenticated attackers to inject and execute arbitrary shortcodes, effectively enabling remote code execution within the context of the WordPress site. Since shortcodes can trigger a wide range of actions, including database queries, file operations, or PHP code execution via other plugins or themes, the impact can be extensive. The vulnerability affects all versions up to and including 2.2.5 and is exploitable over the network without any authentication or user interaction, increasing its risk. Although no public exploits have been reported yet, the ease of exploitation and the widespread use of WooCommerce and this plugin make it a significant threat. The vulnerability compromises confidentiality by potentially exposing sensitive data, integrity by allowing unauthorized content or code changes, and availability by enabling denial-of-service conditions or site defacement.

Organizations running WooCommerce stores with the vulnerable CURCY plugin face risks including unauthorized code execution, data leakage, and site disruption. Attackers could manipulate product pricing, redirect customers, inject malicious content, or gain further access to the underlying server environment. This can lead to financial losses, reputational damage, and regulatory compliance issues, especially for e-commerce businesses handling sensitive customer and payment data. The vulnerability's unauthenticated nature means attackers can exploit it remotely without credentials, increasing the attack surface. Given WooCommerce's global popularity, the threat could impact small to large online retailers worldwide, potentially affecting customer trust and operational continuity.

Immediate mitigation involves updating the CURCY plugin to a patched version once released by the vendor. Until a patch is available, administrators should disable or remove the CURCY plugin to eliminate the attack vector. Implementing Web Application Firewall (WAF) rules to detect and block suspicious shortcode patterns or attempts to invoke do_shortcode via user input can provide temporary protection. Restricting access to the WordPress REST API and limiting anonymous user capabilities can reduce exploitation risk. Regularly auditing installed plugins for vulnerabilities and minimizing plugin use to trusted, actively maintained ones is recommended. Monitoring logs for unusual shortcode execution or unexpected site behavior can aid early detection of exploitation attempts.