CVE-2025-60114 MEDIUM

CVE-2025-60114: WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerability

Vendor Yaycommerce
Product YayCurrency
Weakness CWE-94 · Code injection
Published September 26, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Improper Control of Generation of Code ('Code Injection') vulnerability in YayCommerce YayCurrency yaycurrency allows Code Injection.This issue affects YayCurrency: from n/a through <= 3.3.1.

Explanation of Vulnerability in Simple Terms

02Summary

YayCurrency versions up to 3.3.1 contain a code injection vulnerability that allows high-privilege users to inject and execute arbitrary code on the site. The vulnerability requires administrator-level access and affects the site's confidentiality, integrity, and availability. Update to version 3.3.4 or later to remediate.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the site with the privileges of the injected context.

Potential impact on your site

04Site Impact

A compromised admin account could inject malicious code affecting site data, functionality, and availability.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative access to the YayCurrency plugin.

Key dates

06Disclosure timeline

September 26, 2025 CVE published
April 28, 2026 Record updated