What is the CVSS score of CVE-2026-9241?

CVE-2026-9241 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

FOX Currency Switcher CVE-2026-9241

EUVD-2026-32703 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-28 Wordfence

GHSA-44mh-4g8r-7822

PHP WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 05:00 vuln.today

CVE Published

May 28, 2026 - 03:27 nvd

MEDIUM 4.3

DescriptionCVE.org

The FOX - Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 1.4.6. This is due to the get_value() function in classes/fixed/fixed_user_role.php trusting the attacker-controlled $_REQUEST['wooc_order_user_roles'] parameter to determine the user's role context for role-based price resolution without any validation, allowing it to override the legitimate role data derived from the authenticated user's session object via $user->roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate higher-privileged roles - such as wholesale customer or administrator - and obtain discounted or otherwise restricted pricing that should not be available to their actual role. This vulnerability only has practical impact when the fixed user-role pricing feature is enabled and at least one product has a privileged-role price configured.

AnalysisAI

Authorization bypass in FOX - Currency Switcher Professional for WooCommerce (all versions through 1.4.6) allows authenticated attackers with Subscriber-level access to impersonate higher-privileged roles - such as wholesale customers or administrators - to obtain discounted or otherwise role-restricted product pricing. The flaw stems from the plugin's fixed user-role pricing engine blindly trusting a client-supplied HTTP request parameter over the server-side session object when resolving a user's role for price calculation. No public exploit is identified at time of analysis, and real-world impact is bounded by a non-default configuration requirement, keeping the CVSS base score at 4.3.

Technical ContextAI

The affected code resides in classes/fixed/fixed_user_role.php within the WordPress plugin developed by realmag777 (CPE: cpe:2.3:a:realmag777:fox_-_currency_switcher_professional_for_woocommerce:*:*:*:*:*:*:*:*). The get_value() function, visible at line 228-229 of that file, reads the $_REQUEST['wooc_order_user_roles'] superglobal - which aggregates GET, POST, and COOKIE inputs - and uses it directly as the role context for price resolution, bypassing the legitimate role data held in $user->roles on the authenticated session object. This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key) pattern: a security decision (role-based price entitlement) is delegated to an attacker-controllable input rather than an authoritative server-side source. The WooCommerce fixed user-role pricing feature is the specific subsystem affected, as confirmed by the Wordfence advisory.

RemediationAI

An upstream fix has been committed to the plugin's Subversion repository as changeset 3543524 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3543524%40woocommerce-currency-switcher&new=3543524%40woocommerce-currency-switcher); a released patched version number is not independently confirmed from the available data, so administrators should update to the latest available version from the WordPress plugin directory and verify it incorporates changeset 3543524. As an immediate compensating control for sites that cannot update promptly, disabling the fixed user-role pricing feature entirely removes the exploitable code path - this is the most targeted mitigation, though it sacrifices the role-based pricing functionality. Alternatively, restricting new user registrations to prevent untrusted Subscriber accounts and auditing existing Subscriber-level users can reduce exposure. Web application firewall rules blocking unexpected values in the wooc_order_user_roles request parameter may provide additional defense-in-depth, though parameter-level WAF filtering has limited reliability against evasion. Consult the Wordfence advisory for updated patch confirmation.