What is the CVSS score of CVE-2026-4094?

CVE-2026-4094 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of FOX Currency Switcher Professional are affected by CVE-2026-4094?

FOX Currency Switcher Professional for WooCommerce (versions ≤1.4.6) contains a critical vulnerability allowing authenticated attackers and administrators to delete entire multi-currency…

How to fix or mitigate CVE-2026-4094?

Within 24 hours: Inventory all WooCommerce installations running FOX Currency Switcher Professional and identify current plugin versions. Within 7 days: Upgrade all affected installations to version 1.4.6 or later per Wordfence advisory; if upgrades cannot be completed, disable the plugin immediately. Within 30 days: Conduct audit of multi-currency configuration integrity, verify backup restoration procedures, and implement Web Application Firewall (WAF) rules to block malicious parameter patterns targeting wp-admin pages on affected sites.

FOX Currency Switcher Professional CVE-2026-4094

EUVD-2026-30507 HIGH

Missing Authorization (CWE-862)

2026-05-15 Wordfence

GHSA-89r5-8vmx-vfxj

WordPress Authentication Bypass CSRF Fox Currency Switcher Professional For Woocommerce Wordpress Plugin Realmag777

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 07:30 vuln.today

CVE Published

May 15, 2026 - 06:45 nvd

HIGH 8.1

DescriptionCVE.org

The FOX - Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'admin_head' function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete the entire multi-currency configuration by visiting any wp-admin page with the woocs_reset parameter appended. Additionally, because no nonce is verified, this is also exploitable via Cross-Site Request Forgery against any administrator. The vulnerability may also be exploited by Subscriber-level users if the site is configured to allow Subscriber access to 'wp-admin' pages.

AnalysisAI

Authenticated attackers with Contributor-level access can delete entire multi-currency configurations in FOX Currency Switcher Professional for WooCommerce by visiting any wp-admin page with a specific parameter, and the lack of nonce verification allows CSRF-based exploitation against administrators. Confirmed actively exploited (CISA KEV). CVSS 8.1 reflects high integrity and availability impact, with EPSS data unavailable. WordPress plugin affects versions ≤1.4.5, with patch released in version 1.4.6 per Wordfence advisory. The dual attack vectors (direct authenticated abuse and CSRF) significantly increase real-world risk for WooCommerce installations using this currency management plugin.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization) in the 'admin_head' hook handler within the FOX Currency Switcher Professional plugin's core class (woocs.php). The plugin fails to validate user capabilities before processing the 'woocs_reset' parameter, which triggers deletion of stored multi-currency settings from the WordPress database. The absence of WordPress nonce verification compounds the issue, allowing Cross-Site Request Forgery attacks. The affected CPE (cpe:2.3:a:realmag777:fox_-_currency_switcher_professional_for_woocommerce) identifies this as a third-party WooCommerce extension for managing currency conversion and display across e-commerce stores. The vulnerability exists in the admin_head function execution path, accessible to any authenticated user with wp-admin access, bypassing WordPress's standard capability checking mechanisms that should restrict administrative functions to appropriate user roles.

RemediationAI

Upgrade immediately to FOX Currency Switcher Professional version 1.4.6 or later, which implements proper capability checks and nonce verification per the patch committed in changeset 3483839 (https://plugins.trac.wordpress.org/changeset/3483839/). If immediate patching is not feasible, implement these compensating controls: (1) Restrict wp-admin access to only Administrator and Editor roles by removing Contributor/Subscriber wp-admin capabilities via role management plugins or custom code - this prevents direct exploitation but does not address CSRF risk; (2) Deploy Web Application Firewall rules to block requests containing the 'woocs_reset' parameter from non-administrator IP addresses - note this may break legitimate admin workflows and can be bypassed via CSRF; (3) Backup multi-currency configuration data before applying any mitigations to enable rapid restoration if data loss occurs. WARNING: Compensating controls provide incomplete protection against CSRF vectors and should be considered temporary measures only. The advisory from Wordfence is available at the threat intelligence URL listed above. Verify the installed version via WordPress admin panel under Plugins before and after upgrade to confirm successful patching.