The CURCY – Multi Currency for WooCommerce – Smoothly plugin for WordPress allows malicious content supplied via the 'exchange' parameter to be directly passed to WordPress’s do_shortcode function without any validation. This missing validation makes the plugin a CWE‑94 Stored Command Injection issue, enabling an attacker to inject and run arbitrary shortcodes on the site. The shortcodes are executed with the privileges of the web‑application, potentially allowing remote code execution or other harmful actions within the WordPress environment.

Villatheme’s CURCY Smoothly plugin, installed on WooCommerce 9.x sites, is affected for all publicly released versions up to and including 2.2.14. WordPress sites that have not yet updated the plugin remain vulnerable to this flaw.

The flaw carries a CVSS score of 5.4, indicating moderate severity. EPSS is less than 1%, suggesting that active exploitation is currently rare and the flaw is not listed in CISA KEV. The likely attack vector is an unauthenticated HTTP request that includes a crafted 'exchange' parameter, as the plugin’s code path does not enforce any authentication before calling do_shortcode. Because no login is needed and any network user may craft such a request, the practical exploitation risk is straightforward, though the low EPSS score indicates a low probability of real‑world attacks at present. Nonetheless, the potential impact remains significant due to the remote code execution capability inherent in executing arbitrary shortcodes.