EUVD-2026-20164
GHSA-jx9c-j2q7-694g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privilege user
-
DeliveryCraft malicious SQL in currency parameter
-
ExploitInject blind SQL payload
-
ExecutionExfiltrate database information
-
ImpactCause service disruption
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires high-privilege authenticated administrator access to RealMag777 FOX woocommerce-currency-switcher plugin versions <= 1.4.5. Remote attacker must have WordPress admin credentials to inject SQL commands through vulnerable parameters. No victim interaction needed. |
| Impact | CVSS 7.6 reflects high confidentiality impact, but requires authenticated high-privilege access (PR:H), severely limiting real-world applicability. EPSS 0.02% indicates low observed exploitation activity. WooCommerce plugin context narrows exposure to site administrators. Priority tier: moderate for WordPress administrators managing FOX currency switcher; low for general internet risk. |
| Exploit ScenarioDerived | Authenticated administrator accesses vulnerable endpoint, injects SQL payload into currency-switcher parameter to extract database contents via blind SQL injection. No public exploit code identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Blind SQL injection in FOX WooCommerce Currency Switcher plugin (versions ≤1.4.5) allows authenticated high-privilege users to extract database contents via crafted SQL commands. Attacker requires high-privilege access (PR:H) but can breach scope boundaries (S:C), achieving high confidentiality impact and limited availability disruption. No public exploit identified at time of analysis. Affects WordPress installations using the vulnerable plugin for multi-currency e-commerce functionality.
RemediationAI
No vendor-released patch identified at time of analysis for versions beyond 1.4.5. Immediately audit administrative user permissions and restrict high-privilege account access to trusted personnel only. Monitor database query logs for anomalous SQL patterns. Consider disabling the FOX WooCommerce Currency Switcher plugin until patched version becomes available. Implement Web Application Firewall (WAF) rules targeting SQL injection patterns in plugin parameters. Consult Patchstack advisory for emerging remediation guidance: https://patchstack.com/database/Wordpress/Plugin/woocommerce-currency-switcher/vulnerability/wordpress-fox-plugin-1-4-5-sql-injection-vulnerability. Verify NVD updates at https://nvd.nist.gov/vuln/detail/CVE-2026-39497 for vendor patch announcements.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-89 blind SQL injection stemming from improper input neutralization in database queries. Attack vector requires network access with low complexity (AC:L) but high privilege level. Scope change indicator (S:C) suggests potential cross-boundary impact beyond plugin context, enabling database-wide information disclosure despite authentication requirement.
Know when Fox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Blind SQL Injection.This issue affects FOX: from n/a through <= 1.4.5.
Executive ViewAI
FOX WooCommerce Currency Switcher plugin versions 1.4.5 and earlier contain a blind SQL injection vulnerability that allows high-privilege WordPress users to extract sensitive database contents, creating insider threat and privilege escalation risks for e-commerce platforms. Organizations using this plugin should immediately audit administrative access and disable the plugin until a patch becomes available, as the vulnerability bypasses application boundaries and directly threatens customer and transactional data confidentiality.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable FOX WooCommerce Currency Switcher plugin entirely and deploy alternative currency-switching solution; (2) Restrict WordPress administrator role to essential personnel only and enforce multi-factor authentication on all administrative accounts; (3) Implement database activity monitoring and SQL query logging to detect blind SQL injection attempts; (4) Apply Web Application Firewall (WAF) rules to block suspicious SQL patterns in plugin requests; (5) Regularly audit database user permissions to enforce principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Missing authorization in RealMag777 FOX woocommerce-currency-switcher plugin for WordPress allows unauthenticated remote
Missing authorization in the FOX (WooCommerce Currency Switcher) WordPress plugin through version 1.5.4 allows remote at
Exploit-DB