FOX Currency Switcher CVE-2026-9241

Exploitation requires an authenticated session at Subscriber level or above (confirmed by CVSS PR:L). Two configuration conditions must both be true for the vulnerability to have practical impact: the fixed user-role pricing feature must be enabled within the FOX Currency Switcher plugin settings, and at least one product in the WooCommerce catalog must have a price configured for a privileged role (e.g., wholesale customer, administrator) that differs from the standard price. Sites using the plugin solely for currency switching without role-based fixed pricing are not affected. Exploitation is not automatable at scale since a valid authenticated session is required, and the attack is bounded to price manipulation rather than account takeover or data exfiltration. No platform-specific or server-side configuration beyond the above is required.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) characterizes this as a low-complexity, network-reachable integrity issue requiring only low-privilege authentication - consistent with the Subscriber-level threshold described. The score of 4.3 is appropriate: there is no confidentiality or availability impact, and the integrity impact is narrow (price manipulation, not data corruption or account takeover). EPSS data was not provided, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. No POC is publicly identified at time of analysis. Real-world risk is further constrained by the non-default configuration dependency (fixed user-role pricing must be enabled and at least one product must carry a privileged-role price), meaning many WooCommerce deployments using this plugin will not be exploitable at all. For wholesale or B2B WooCommerce stores relying on role-based tiered pricing, however, the business impact - competitors or resellers obtaining unauthorized wholesale rates - could be meaningful despite the modest CVSS score. Overall, this is a genuine but contextually limited vulnerability; prioritization should be driven by whether the fixed user-role pricing feature is in active use.

An attacker registers or already holds a Subscriber-level account on a WooCommerce store running this plugin with fixed user-role pricing enabled. They craft a standard authenticated POST or GET request to a product page or cart endpoint, injecting a spoofed role name (e.g., 'wholesale_customer' or 'administrator') into the wooc_order_user_roles parameter. The plugin's get_value() function accepts this parameter at face value, resolves the privileged-role price tier, and returns the discounted or restricted price to the attacker - who then completes a purchase at the unauthorized rate.