Security readout for executives and security teams
Plain-English summary
CVE-2024-13487 affects the CURCY Multi Currency for WooCommerce WordPress plugin. On vulnerable versions, an unauthenticated attacker may cause WordPress shortcodes to run through a plugin price-cache function. Business impact depends on what shortcodes exist on the site, but the issue can affect confidentiality, integrity, and availability.
Executive priority
Treat this as a near-term WordPress remediation item for WooCommerce estates. Prioritize internet-facing stores, especially where many third-party shortcodes or sensitive commerce workflows are installed.
Technical view
The vulnerability is arbitrary shortcode execution in get_products_price(), where user-controlled input is not properly validated before do_shortcode is called. Wordfence rates it CVSS 7.3 high, network exploitable, low complexity, no privileges, and no user interaction. Reported affected versions are up to and including 2.2.5.
Likely exposure
Public WordPress/WooCommerce sites using CURCY Multi Currency for WooCommerce versions up to 2.2.5 are the likely exposed population. Sites without this plugin are not exposed based on the supplied sources.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. The risk is still meaningful because the flaw is unauthenticated, remotely reachable, and tied to shortcode execution inside WordPress.
Researcher notes
Evidence supports arbitrary shortcode execution, not general PHP code execution. Impact will vary by installed shortcodes and site configuration. The provided affected metadata is sparse, so version validation should rely on the plugin changelog, CVE record, Wordfence entry, and Trac changeset.
Mitigation direction
- Upgrade CURCY Multi Currency for WooCommerce to the current vendor-published release.
- Remove or disable the plugin if an immediate update is not possible.
- Review vendor changelog and WordPress Trac changeset for the relevant fix.
- Limit unnecessary shortcodes and plugins that expose sensitive or state-changing behavior.
Validation and detection
- Inventory WordPress sites for the woo-multi-currency plugin.
- Confirm installed plugin versions are newer than 2.2.5.
- Review the patched cache.php logic for validation before do_shortcode.
- Check WordPress and web logs for unusual unauthenticated requests to plugin endpoints.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-13487 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L3.93.4WordfenceVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineWordfence
Disclosed
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d630dd85-0169-4582-a8ae-54e5053425ac?source=cveCVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/woo-multi-currency/trunk/frontend/cache.php#L60CVE reference, Wordfence
- https://wordpress.org/plugins/woo-multi-currency/#developersCVE reference, Wordfence
- https://plugins.trac.wordpress.org/changeset/3234505/CVE reference, Wordfence
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.