The WooCommerce Multilingual & Multicurrency plugin contains a missing authorization check that permits an attacker to alter the plugin’s configuration settings. Identified as CWE‑862, this vulnerability enables unauthorized modification of multilingual and multicurrency behavior, potentially disrupting site functionality and user experience. The description does not indicate data exfiltration or remote code execution. The likely attack vector is through the WordPress administrative interface, where an attacker with a compromised or insufficiently privileged account might exploit the incorrect access‑control enforcement; this inference is based on the reference to incorrectly configured access‑control security levels.

Amir Helzer’s WooCommerce Multilingual & Multicurrency plugin for WordPress, version 5.3.8 and all earlier releases, is affected.

The CVSS score of 5.3 denotes moderate severity, while the EPSS score of less than 1 % indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been observed in widespread attacks. Exploitation would require access to the plugin’s configuration interface, likely under a user account that has insufficient privileges. Due to the moderate impact and low exploitation likelihood, urgent patching is still recommended to mitigate potential privilege escalation.