CVE-2026-108174
5.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-862
Impact
Unauthenticated remote attackers can alter plugin settings or data over the network due to broken access controls. They need only direct network access to the exposed WordPress site.
Root cause
The plugin fails to perform authorization checks on sensitive functions, allowing unauthorized actions via incorrectly configured access control levels.
Affected systems
FOX woocommerce-currency-switcher through version 1.5.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Fix & remediation
Upgrade FOX woocommerce-currency-switcher to a version newer than 1.5.4 once released. If a patch is unavailable, deactivate and disable the plugin immediately until fixed.
$ wp plugin update woocommerce-currency-switcherAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4.