CVE-2026-2582

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2582", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-16T12:12:39.009Z", "datePublished": "2026-04-14T06:43:52.199Z", "dateUpdated": "2026-04-14T14:04:52.319Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-14T06:43:52.199Z"}, "affected": [{"vendor": "vendidero", "product": "Germanized for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.20.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The The Germanized for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution via 'account_holder' parameter in all versions up to, and including, 3.20.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes."}], "title": "Germanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9e6837ad-576f-4c25-9540-6144ddc8630e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/3.20.5/includes/gateways/direct-debit/class-wc-gzd-gateway-direct-debit.php#L982"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/3.20.5/includes/gateways/direct-debit/class-wc-gzd-gateway-direct-debit.php#L214"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Chiao-Lin Yu"}], "timeline": [{"time": "2026-02-07T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-03-30T17:54:32.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-13T17:42:17.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2582", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T14:02:06.494764Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T14:04:52.319Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2582", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T14:02:06.494764Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T14:04:03.651Z"}}], "cna": {"title": "Germanized for WooCommerce <= 3.20.5 - Unauthenticated Arbitrary Shortcode Execution", "credits": [{"lang": "en", "type": "finder", "value": "Chiao-Lin Yu"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "vendidero", "product": "Germanized for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.20.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-07T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-03-30T17:54:32.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-13T17:42:17.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9e6837ad-576f-4c25-9540-6144ddc8630e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/3.20.5/includes/gateways/direct-debit/class-wc-gzd-gateway-direct-debit.php#L982"}, {"url": "https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/3.20.5/includes/gateways/direct-debit/class-wc-gzd-gateway-direct-debit.php#L214"}], "descriptions": [{"lang": "en", "value": "The The Germanized for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution via 'account_holder' parameter in all versions up to, and including, 3.20.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-14T06:43:52.199Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2582", "state": "PUBLISHED", "dateUpdated": "2026-04-14T14:04:52.319Z", "dateReserved": "2026-02-16T12:12:39.009Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-14T06:43:52.199Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Germanized for WooCommerce", "vendor": "vendidero", "versions": [{"lessThanOrEqual": "3.20.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The The Germanized for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution via 'account_holder' parameter in all versions up to, and including, 3.20.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes."}], "id": "CVE-2026-2582", "lastModified": "2026-06-17T10:31:21.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2582", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T14:02:06.494764Z", "version": "2.0.3"}}]}, "published": "2026-04-14T07:16:06.993", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/3.20.5/includes/gateways/direct-debit/class-wc-gzd-gateway-direct-debit.php#L214"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/3.20.5/includes/gateways/direct-debit/class-wc-gzd-gateway-direct-debit.php#L982"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9e6837ad-576f-4c25-9540-6144ddc8630e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.20.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Germanized for WooCommerce", "source": "cna", "vendor": "vendidero"}, "product": "germanized_for_woocommerce", "vendor": "vendidero"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-14T09:21:47.937494+00:00", "value": {"mitigation_remediation": ["Upgrade the Germanized for WooCommerce plugin to the latest available version when a patch is released.", "If an immediate upgrade is not possible, disable the Direct Debit gateway module or block access to its endpoint to prevent exploitation.", "Enable automatic updates for the plugin if this feature is supported to receive future security patches promptly.", "Monitor web server and application logs for suspicious usage of the account_holder parameter or unexpected shortcode execution."], "summary": {"action": "Update Plugin", "impact": "Shortcode Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Germanized for WooCommerce plugin by Vendidero on WordPress sites. All releases up to and including version 3.20.5 are vulnerable. Any site running these versions and the Direct Debit gateway module may be at risk.", "description_and_impact": "The Germanized for WooCommerce plugin for WordPress allows attackers to exploit the \"account_holder\" parameter without proper validation. The plugin passes this value directly to WordPress\u2019s do_shortcode function, which enables the execution of any shortcode supplied by an attacker. This flaw means that an unauthenticated user can run arbitrary shortcodes that may read or modify site data, inject malicious content, or perform other unintended actions.", "risk_and_exploitability": "With a CVSS base score of 6.5, the flaw is rated moderate in severity. Because authentication is not required, any external actor who can reach the site can potentially exploit it. The likely attack vector involves sending a crafted HTTP request to the Direct Debit gateway endpoint that includes a malicious \"account_holder\" value, a scenario inferred from the description. The vulnerability is not listed in the CISA KEV catalog, and no EPSS score is available, but the straightforward nature of the attack vector suggests that exploitation is plausible."}}}}, "created": "2026-04-14T16:15:51.548457+00:00", "updated": "2026-04-14T16:30:48.110414+00:00", "vendors": ["vendidero", "vendidero$PRODUCT$germanized_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}