Wbw Currency Switcher For Woocommerce CVE-2026-32410

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates a network-exploitable vulnerability with low attack complexity and no privileges required, which are concerning indicators. However, the impact is limited to integrity (modifications only) with no confidentiality or availability impact, and the scope is unchanged (within the vulnerable component only). While the CVSS score of 5.3 places this in the medium severity band, the real-world risk depends on exploitation probability and automatable impact. The absence of CISA KEV status suggests this vulnerability is not yet being actively exploited at scale, and the lack of publicly disclosed proof-of-concept code moderates the immediate risk. For WooCommerce store operators, the integrity impact is material because unauthorized modifications to currency settings could disrupt transactions, enable pricing fraud, or compromise store functionality. Organizations should prioritize patching, particularly if they operate high-transaction-volume stores, but this does not warrant emergency response procedures.

An unauthenticated attacker could directly access the vulnerable authorization endpoint (likely a WordPress AJAX action or REST API route) and submit a crafted request to modify currency switcher settings, such as changing exchange rates, enabling or disabling specific currencies, or altering pricing configurations. Because the vulnerability requires no authentication, the attacker needs only knowledge of the vulnerable endpoint URL, which can be discovered through standard WordPress enumeration techniques or by reverse-engineering the plugin's JavaScript. The attacker could automate this attack against multiple WooCommerce stores, enabling price manipulation or availability attacks.