CVE-2026-62130 WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability

Q: What is CVE-2026-62130?

CVE-2026-62130 is a high-severity unsafe deserialization vulnerability in Amir Helzer WooCommerce Multilingual & Multicurrency, published on 10 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Q: Is CVE-2026-62130 being exploited?

There is no known exploitation of CVE-2026-62130 in the wild and no public exploit code.

Q: How do I fix CVE-2026-62130?

No fix has been published for CVE-2026-62130 yet. Limit exposure of the affected software until one is available.

High 7.2 Published 10 Oct 2026 Updated 11 Oct 2026

A shop manager can exploit PHP object injection in the WooCommerce Multilingual & Multicurrency plugin to potentially execute arbitrary code.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-62130?

CVE-2026-62130 is a high-severity unsafe deserialization vulnerability in Amir Helzer WooCommerce Multilingual & Multicurrency, published on 10 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

Weakness: CWE-502

Which versions are affected by CVE-2026-62130?

How do I fix CVE-2026-62130?

No fix has been published for CVE-2026-62130 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2026-62130 being exploited?