CVE-2026-4094highCWE-862

CVE-2026-4094: falha de alta gravidade em realmag777 FOX – Currency Switcher…

FOX – Currency Switcher Professional for WooCommerce <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configuration Deletion

Publicada em

Seguir esta CVE+ Monitorar FOX – Currency Switcher Professional for WooCommerce

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.3%
The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'admin_head' function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete the entire multi-currency configuration by visiting any wp-admin page with the `woocs_reset` parameter appended. Additionally, because no nonce is verified, this is also exploitable via Cross-Site Request Forgery against any administrator. The vulnerability may also be exploited by Subscriber-level users if the site is configured to allow Subscriber access to 'wp-admin' pages.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
realmag777 · FOX – Currency Switcher Professional for WooCommerce
CVEs relacionadas — realmag777 FOX – Currency Switcher…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3734MEDIUMFOX – Currency Switcher Professional for WooCommerce <= 1.4.1.8 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 1.0%CVE-2024-8271HIGHFOX – Currency Switcher Professional for WooCommerce <= 1.4.2.1 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.7%CVE-2024-10640HIGHThe FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode ExecutionEPSS 0.5%CVE-2023-6556MEDIUMFOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2023-49834MEDIUMWordPress WOOCS – WooCommerce Currency Switcher Plugin <= 1.4.1.4 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2026-9241MEDIUMFOX – Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' ParameterEPSS 0.2%