{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://wordpress.org/plugins","packageName":"woocommerce-multilingual","product":"WooCommerce Multilingual & Multicurrency","source":"CNA: Patchstack","vendor":"OnTheGoSystems","versions":[{"changes":[{"at":"5.3.7","status":"unaffected"}],"lessThanOrEqual":"5.3.6","status":"affected","version":"0","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:onthegosystems:woocommerce_multilingual_\\&_multicurrency:*:*:*:*:*:wordpress:*:*","versionEndExcluding":"5.3.7","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2024-44006","cwes":["CWE-862"],"description":"Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency woocommerce-multilingual.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.6.","epss":{"date":"2026-11-07","percentile":0.29958,"score":0.0036},"exploits":[],"kev":null,"metrics":[{"score":4.3,"severity":"medium","source":"CNA: Patchstack","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},{"score":8.8,"severity":"high","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":4.3,"severity":"medium","source":"NVD: audit@patchstack.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794129393923,"publishedAt":1730470630608,"references":[{"source":"CNA: Patchstack","tags":["vdb-entry"],"url":"https://patchstack.com/database/wordpress/plugin/woocommerce-multilingual/vulnerability/wordpress-woocommerce-multilingual-multicurrency-plugin-5-3-7-broken-access-control-vulnerability?_s_id=cve"},{"source":"audit@patchstack.com","tags":[],"url":"https://patchstack.com/database/wordpress/plugin/woocommerce-multilingual/vulnerability/wordpress-woocommerce-multilingual-multicurrency-plugin-5-3-7-broken-access-control-vulnerability?_s_id=cve"}],"remediation":[{"kind":"fix","source":"CNA: Patchstack","text":"Update the WordPress WooCommerce Multilingual & Multicurrency plugin to the latest available version (at least 5.3.7)."}],"revision":"5c661d73d98dfd737f5b80fdd339c7751079580c6b3abf1ecab27e5e7e553ec3","sources":[{"modifiedAt":1794126734676,"name":"CNA: Patchstack","retrievedAt":1794128900808,"url":"https://www.cve.org/CVERecord?id=CVE-2024-44006"},{"modifiedAt":1794129393923,"name":"NVD","retrievedAt":1794140141360,"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44006"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794128935429,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-44006"}],"ssvc":{"assessedAt":1730743272521,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.7 - Broken Access Control vulnerability","updatedAt":1794140141360}