EUVD-2026-20166
GHSA-wxmh-w8w2-m533
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Missing Authorization vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through <= 1.4.5.
AnalysisAI
Missing authorization in RealMag777 FOX woocommerce-currency-switcher plugin for WordPress allows unauthenticated remote attackers to bypass access controls and gain read access to sensitive data through incorrectly configured security levels. The vulnerability affects FOX versions up to and including 1.4.5, with a CVSS score of 5.3 and extremely low exploitation probability (EPSS 0.02%), suggesting limited real-world attack incentive despite the missing authorization flaw.
Technical ContextAI
The vulnerability stems from improper access control implementation (CWE-862: Missing Authorization) in the FOX woocommerce-currency-switcher WordPress plugin. This class of flaw occurs when an application fails to verify user permissions before exposing sensitive functionality or data. The plugin, which manages currency switching functionality in WooCommerce environments, does not properly enforce authorization checks on certain endpoints or operations, allowing attackers without authentication (PR:N per CVSS vector) to access protected resources. The affected product is identified by CPE cpe:2.3:a:realmag777:fox:*:*:*:*:*:*:*:* across all versions from inception through 1.4.5.
RemediationAI
Update the FOX woocommerce-currency-switcher plugin to a version after 1.4.5. Patch availability beyond version 1.4.5 is inferred from Patchstack's disclosure; vendor-released patched version numbers are not explicitly confirmed in available data. Site administrators should immediately upgrade to the latest available version through the WordPress plugin manager or directly from the plugin repository. Until patching is possible, restrict access to the affected plugin via web application firewall rules if the specific vulnerable endpoint can be identified. Additional mitigation includes conducting a security audit of custom access control implementations and applying WordPress-wide authentication/authorization hardening per WordPress security guidelines.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today