What is the CVSS score of CVE-2026-39497?

CVE-2026-39497 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-39497?

FOX WooCommerce Currency Switcher plugin versions 1.4.5 and earlier contain a blind SQL injection vulnerability that allows high-privilege WordPress users to extract sensitive database contents,…

How to fix or mitigate CVE-2026-39497?

Within 24 hours: Identify all WordPress installations using FOX WooCommerce Currency Switcher and document current plugin version via wp-cli or admin dashboard; audit administrative user accounts and recent activity logs for suspicious queries. Within 7 days: Either disable the vulnerable plugin (versions ≤1.4.5) and switch to an alternative currency-switching solution, or restrict administrative access to only essential personnel; implement database activity monitoring. Within 30 days: Monitor FOX Software's advisory channels and security repository for patch release; conduct a database audit for signs of unauthorized data extraction.

WordPress CVE-2026-39497

EUVD-2026-20164 HIGH

SQL Injection (CWE-89)

2026-04-08 Patchstack

GHSA-jx9c-j2q7-694g

SQLi WordPress

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20164

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Blind SQL Injection.This issue affects FOX: from n/a through <= 1.4.5.

AnalysisAI

Blind SQL injection in FOX WooCommerce Currency Switcher plugin (versions ≤1.4.5) allows authenticated high-privilege users to extract database contents via crafted SQL commands. Attacker requires high-privilege access (PR:H) but can breach scope boundaries (S:C), achieving high confidentiality impact and limited availability disruption. No public exploit identified at time of analysis. Affects WordPress installations using the vulnerable plugin for multi-currency e-commerce functionality.

Technical ContextAI

CWE-89 blind SQL injection stemming from improper input neutralization in database queries. Attack vector requires network access with low complexity (AC:L) but high privilege level. Scope change indicator (S:C) suggests potential cross-boundary impact beyond plugin context, enabling database-wide information disclosure despite authentication requirement.

RemediationAI

No vendor-released patch identified at time of analysis for versions beyond 1.4.5. Immediately audit administrative user permissions and restrict high-privilege account access to trusted personnel only. Monitor database query logs for anomalous SQL patterns. Consider disabling the FOX WooCommerce Currency Switcher plugin until patched version becomes available. Implement Web Application Firewall (WAF) rules targeting SQL injection patterns in plugin parameters. Consult Patchstack advisory for emerging remediation guidance: https://patchstack.com/database/Wordpress/Plugin/woocommerce-currency-switcher/vulnerability/wordpress-fox-plugin-1-4-5-sql-injection-vulnerability. Verify NVD updates at https://nvd.nist.gov/vuln/detail/CVE-2026-39497 for vendor patch announcements.