FOX Currency Switcher CVE-2026-108174

Requires only that a target WordPress site be running the PluginUs.Net FOX (WooCommerce Currency Switcher) plugin at version 1.5.4 or earlier with the vulnerable code path reachable; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are indicated as prerequisites, so a default installation is exploitable over the network. The principal limiting factor is impact scope rather than access: the flaw yields only a partial integrity effect (C:N/I:L/A:N), so it does not by itself disclose data or disrupt availability, and exploitation value depends on what the specific unauthorized plugin action allows. The exact vulnerable feature/endpoint is not named in the provided description and should be confirmed against the Patchstack advisory.

This is a moderate-severity Missing Authorization (CWE-862) flaw in the FOX / WooCommerce Currency Switcher plugin, scored CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - network-reachable, low attack complexity, no privileges and no user interaction, but with impact limited to integrity only (C:N/I:L/A:N). The signals are internally consistent: the low score is driven not by access difficulty but by limited impact, meaning an unauthenticated attacker can reach the vulnerable function easily yet can only achieve a partial integrity effect (e.g., modifying or triggering a plugin setting/action that should require authorization), with no confidentiality or availability consequence. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified from available signals. On balance this is a real but secondary priority: broken-access-control bugs in widely installed WordPress/WooCommerce plugins are routinely exploited in opportunistic campaigns, but the integrity-only, no-confidentiality impact makes it lower-urgency than a data-disclosure or RCE flaw. Treat as a patch-in-normal-cycle item unless the specific unauthorized action proves to enable a more damaging follow-on.

An unauthenticated remote attacker sends a crafted HTTP request directly to an AJAX or action endpoint exposed by the FOX plugin that fails to perform a capability/authorization check, invoking a privileged plugin operation they should not be able to reach. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, the request can be scripted against any site running the vulnerable plugin. No public exploit code was identified at time of analysis.