CVE-2026-62130
Deferred Deferred - Pending Action

Shop Manager PHP Object Injection in WooCommerce Multilingual & Multicurrency

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: Patchstack

Description
Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-13
Generated
2026-10-19
AI Q&A
2026-10-11
EPSS Evaluated
2026-10-18
NVD
CVE-2026-62130
EUVD
EUVD-2026-96512

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Amir Helzer WooCommerce Multilingual & Multicurrency n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62130 is a PHP Object Injection vulnerability in the WooCommerce Multilingual & Multicurrency plugin for WordPress, affecting versions 5.5.8 and below. Attackers can exploit this to manipulate server-side data processing, potentially leading to harmful actions.

Detection Guidance

Detection involves checking for vulnerable versions of the WooCommerce Multilingual & Multicurrency plugin. Inspect installed plugins via WordPress admin panel or database. Use commands like 'wp plugin list' in WP-CLI or check the plugin's version in the 'wp_options' table.

Impact Analysis

This vulnerability could allow attackers to execute unauthorized actions on your server, such as modifying data, disrupting services, or gaining elevated privileges. It may lead to data breaches or system compromise if exploited.

Compliance Impact

Exploitation could result in unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. This may lead to legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the plugin to version 5.6.3 or later immediately. If updating is not possible, disable the plugin temporarily or seek assistance from your hosting provider or developer. Enable auto-updates for vulnerable plugins if using Patchstack.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62130. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart