PT-2026-41268 · WordPress · Fox – Currency Switcher Professional For Woocommerce
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FOX – Currency Switcher Professional for WooCommerce versions prior to 1.4.6
Description
The plugin is susceptible to unauthorized data loss because the
admin head() function lacks a proper capability check. Authenticated users with Contributor-level access or higher can delete the entire multi-currency configuration by accessing any wp-admin page with the woocs reset parameter. The absence of nonce verification also allows this action to be performed via Cross-Site Request Forgery (CSRF)—a technique where an attacker tricks a victim into performing an action they did not intend—against administrators. Furthermore, Subscriber-level users may exploit this if the site configuration permits them access to wp-admin pages.Recommendations
Update the plugin to a version later than 1.4.5.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fox – Currency Switcher Professional For Woocommerce