Is CVE-2026-62130 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62130 being exploited in the wild.

How severe is CVE-2026-62130?

High severity, with a CVSS score of 7.2, published 10 October 2026.

Which products and versions are affected?

Automattic WooCommerce Multilingual & Multicurrency <= 5.5.8.

Is there a fix for CVE-2026-62130?

Yes: fixed in 5.6.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62130 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-62130?

Check whether you run Automattic WooCommerce Multilingual & Multicurrency at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62130: WooCommerce Multilingual & Multicurrency PHP Object Injection

Q: Is there a fix for CVE-2026-62130?

Yes: fixed in 5.6.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-62130 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-62130?

Check whether you run Automattic WooCommerce Multilingual & Multicurrency at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62130 · Severity: high · CVSS 7.2 · Published 2026-10-10

WooCommerce Multilingual & Multicurrency is a WordPress plugin that extends WooCommerce to support multiple languages and currencies for online stores. A PHP Object Injection vulnerability allows authenticated shop managers to manipulate how the plugin processes data, potentially executing arbitrary code on the server. This could lead to unauthorized access, data theft, or store compromise.

Vendors: Automattic.

Quick answers

Is CVE-2026-62130 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62130 being exploited in the wild.
How severe is CVE-2026-62130?: High severity, with a CVSS score of 7.2, published 10 October 2026.
Which products and versions are affected?: Automattic WooCommerce Multilingual & Multicurrency <= 5.5.8.
Is there a fix for CVE-2026-62130?: Yes: fixed in 5.6.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62130 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-62130?: Check whether you run Automattic WooCommerce Multilingual & Multicurrency at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.6.3

Technical details

A PHP Object Injection vulnerability in WooCommerce Multilingual & Multicurrency versions up to 5.5.8 allows an authenticated shop manager to inject malicious serialized objects. The vulnerability requires shop manager privileges and could enable arbitrary code execution or unsafe operations through the deserialization of untrusted data.

Affected products

Automattic WooCommerce Multilingual & Multicurrency <= 5.5.8

Timeline

2026-10-08: disclosed
2026-10-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.