FOX Currency Switcher Professional CVE-2026-4094

Direct exploitation requires authenticated access with Contributor-level privileges or higher to wp-admin pages in WordPress (PR:L in CVSS). CSRF-based exploitation requires the victim administrator to be authenticated to the WordPress admin panel and to click a malicious link while logged in, but does NOT require the attacker to hold any account on the target site. The vulnerability is exploitable against default WordPress role configurations where Contributors have wp-admin access for post management. Exploitation becomes easier on sites with non-standard configurations granting Subscriber users wp-admin access, as described in the CVE. No special plugin configuration or feature enablement required beyond having the FOX Currency Switcher Professional plugin installed and active. Attack success limited only by the attacker's ability to either obtain low-privilege credentials or deliver CSRF payloads to authenticated administrators. Network accessibility (AV:N) and low attack complexity (AC:L) mean exploitation works against any internet-accessible WordPress installation meeting the privilege requirements.

Real-world risk is CRITICAL for affected WooCommerce stores despite the 8.1 CVSS score appearing just below critical threshold. CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-exploitable attacks with low complexity requiring only low-privilege authentication and no user interaction. The dual exploitation paths significantly elevate practical risk: (1) any Contributor+ user can directly trigger data deletion, and (2) CSRF allows attackers to weaponize administrator sessions via malicious links. CISA KEV listing confirms active exploitation, meaning threat actors are already targeting this vulnerability in production environments. While CVSS PR:L suggests authenticated access required, the CSRF vector effectively bypasses this for social engineering attacks against admins. The high integrity (I:H) and availability (A:H) impacts are accurate - complete loss of multi-currency configuration can disrupt e-commerce operations and corrupt pricing data. Exploitation is automatable via crafted URLs embedded in emails or malicious sites. EPSS score unavailable but KEV status indicates widespread scanning/exploitation activity. This is a real priority requiring immediate patching, particularly for public-facing WooCommerce installations with multiple user roles or external contributor access.

An attacker with a Contributor account on a WooCommerce site crafts a URL to any wp-admin page appending '?woocs_reset=1' (e.g., https://target-site.com/wp-admin/profile.php?woocs_reset=1) and visits it directly, immediately triggering deletion of all multi-currency configuration without administrator intervention. Alternatively, for CSRF exploitation, the attacker embeds this URL in an email or forum post disguised as a legitimate admin link, and when a logged-in administrator clicks it, their authenticated session executes the deletion request. Publicly available exploit code exists per source code analysis showing the vulnerable parameter handling at lines 1167-1168 of woocs.php (https://plugins.trac.wordpress.org/browser/woocommerce-currency-switcher/trunk/classes/woocs.php). The attack requires only knowledge of the target site's domain and can be executed remotely with minimal technical sophistication.