The Germanized for WooCommerce plugin for WordPress allows attackers to exploit the "account_holder" parameter without proper validation. The plugin passes this value directly to WordPress’s do_shortcode function, which enables the execution of any shortcode supplied by an attacker. This flaw means that an unauthenticated user can run arbitrary shortcodes that may read or modify site data, inject malicious content, or perform other unintended actions.

The vulnerability affects the Germanized for WooCommerce plugin by Vendidero on WordPress sites. All releases up to and including version 3.20.5 are vulnerable. Any site running these versions and the Direct Debit gateway module may be at risk.

With a CVSS base score of 6.5, the flaw is rated moderate in severity. Because authentication is not required, any external actor who can reach the site can potentially exploit it. The likely attack vector involves sending a crafted HTTP request to the Direct Debit gateway endpoint that includes a malicious "account_holder" value, a scenario inferred from the description. The vulnerability is not listed in the CISA KEV catalog, and no EPSS score is available, but the straightforward nature of the attack vector suggests that exploitation is plausible.