CVE-2024-13487
Published: 06 February 2025
Summary
CVE-2024-13487 is a high-severity Code Injection (CWE-94) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The CURCY – Multi Currency for WooCommerce plugin for WordPress, in all versions up to and including 2.2.5, contains a vulnerability designated as CVE-2024-13487 that enables arbitrary shortcode execution via the get_products_price() function. The issue stems from insufficient validation of a user-supplied value before it is passed to the do_shortcode() function, allowing malicious shortcodes to be processed and executed.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required, as indicated by the CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Successful exploitation permits execution of arbitrary shortcodes, potentially resulting in limited impacts to confidentiality, integrity, and availability, classified under CWE-94 (Improper Control of Generation of Code).
Mitigation details are available through plugin references, including the vulnerable code at frontend/cache.php line 60, a patch in changeset 3234505 on the WordPress plugin trac, the developers section of the woo-multi-currency plugin page, and Wordfence threat intelligence advisory. Security practitioners should update to a patched version beyond 2.2.5 to address the flaw.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51626
Vulnerability details
The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution via the get_products_price() function in all versions up to, and…
more
including, 2.2.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated exploitation of a public-facing WordPress plugin via arbitrary shortcode injection.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of user-supplied values before passing to functions like do_shortcode, directly preventing arbitrary shortcode execution due to insufficient input validation.
Mandates timely identification, reporting, and correction of flaws in plugins like CURCY, enabling patching to eliminate the arbitrary shortcode execution vulnerability.
Vulnerability scanning detects the presence of CVE-2024-13487 in the CURCY plugin, facilitating risk assessment and remediation to prevent exploitation.