What is the CVSS score of EUVD-2026-20166?

EUVD-2026-20166 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Fox EUVD-2026-20166

| CVE-2026-39501 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Patchstack

GHSA-wxmh-w8w2-m533

WordPress Authentication Bypass Fox Wordpress Plugin Realmag777

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20166

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through <= 1.4.5.

AnalysisAI

Missing authorization in RealMag777 FOX woocommerce-currency-switcher plugin for WordPress allows unauthenticated remote attackers to bypass access controls and gain read access to sensitive data through incorrectly configured security levels. The vulnerability affects FOX versions up to and including 1.4.5, with a CVSS score of 5.3 and extremely low exploitation probability (EPSS 0.02%), suggesting limited real-world attack incentive despite the missing authorization flaw.

Technical ContextAI

The vulnerability stems from improper access control implementation (CWE-862: Missing Authorization) in the FOX woocommerce-currency-switcher WordPress plugin. This class of flaw occurs when an application fails to verify user permissions before exposing sensitive functionality or data. The plugin, which manages currency switching functionality in WooCommerce environments, does not properly enforce authorization checks on certain endpoints or operations, allowing attackers without authentication (PR:N per CVSS vector) to access protected resources. The affected product is identified by CPE cpe:2.3:a:realmag777:fox:*:*:*:*:*:*:*:* across all versions from inception through 1.4.5.

RemediationAI

Update the FOX woocommerce-currency-switcher plugin to a version after 1.4.5. Patch availability beyond version 1.4.5 is inferred from Patchstack's disclosure; vendor-released patched version numbers are not explicitly confirmed in available data. Site administrators should immediately upgrade to the latest available version through the WordPress plugin manager or directly from the plugin repository. Until patching is possible, restrict access to the affected plugin via web application firewall rules if the specific vulnerable endpoint can be identified. Additional mitigation includes conducting a security audit of custom access control implementations and applying WordPress-wide authentication/authorization hardening per WordPress security guidelines.