The Germanized for WooCommerce plugin for WordPress contains a code injection vulnerability (CWE-94) due to improper validation of the 'account_holder' parameter before executing do_shortcode. This allows unauthenticated attackers to inject and execute arbitrary shortcodes, potentially leading to unauthorized actions or information disclosure. The issue affects all versions up to 3.20.5. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No official fix or patch is currently documented.

An attacker can exploit this vulnerability to execute arbitrary shortcodes without authentication, which may lead to unauthorized code execution within the WordPress context. This can compromise the confidentiality and integrity of the affected system. However, there is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected parameter or disabling the Germanized for WooCommerce plugin if feasible. Monitor vendor channels for updates and apply patches promptly once available.