Threats tagged 'ghsa-2r9f-5mcx-5wjj'

The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress contains an SQL Injection vulnerability in all versions up to and including 5.5.7. This flaw arises from insufficient input validation on the currency exchange rate parameter in the save_currency() AJAX handler, which lacks proper capability checks. Authenticated users with Shop Manager-level access or higher can exploit this to inject malicious SQL payloads that are concatenated into ORDER BY clauses without sanitization, potentially exposing sensitive database information.