This vulnerability allows an authenticated user with Shop Manager or higher role to inject arbitrary SQL through the exchange rate field in the WPML Multilingual & Multicurrency for WooCommerce plugin. The plugin concatenates the input directly into an ORDER BY clause without sanitization, enabling attackers to extract or modify database data. The weakness is a classic SQL injection (CWE‑89) and can lead to unauthorized data disclosure or manipulation.

WordPress sites running the WPML Multilingual & Multicurrency for WooCommerce plugin version 5.5.7 and earlier are affected. Any installation of this plugin that has not been upgraded beyond 5.5.7 is susceptible, regardless of the WordPress core version.

The CVSS score of 4.9 indicates moderate severity. EPSS data is unavailable, so the likelihood of exploitation is unclear, but the vulnerability requires only an account with Shop Manager access and above, which are common on e‑commerce sites. The issue is not listed in the CISA KEV catalog, yet an attacker can append SQL statements during the AJAX currency update action to retrieve sensitive information from the database. The attack surface is limited to authenticated users with sufficient privileges, but that role is often granted to many staff members on busy online stores.