A missing authorization check in the CURCY WooCommerce‑Multi‑Currency plugin allows an attacker to invoke any shortcode without proper access control. Because shortcodes can embed data and potentially executable content, the vulnerability could allow an attacker to affect the confidentiality, integrity, or availability of the WordPress site. The CVE description does not confirm arbitrary code execution but notes improper authorization of functionality. Based on the description, it is inferred that malicious shortcodes might be used to compromise the site.

The affected vendor is villatheme; the CURCY WooCommerce‑Multi‑Currency plugin versions from any earlier release up through 2.3.7 are affected. Versions newer than 2.3.7 are not listed as vulnerable.

The CVSS score is 5.3, indicating moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a crafted HTTP request to a WordPress site that has the vulnerable CURCY plugin installed, exploiting the missing ACL checks to execute shortcodes.