Authorization Bypass in WooCommerce Multi Currency Plugin for WordPress

CVE-2021-4379

What is CVE-2021-4379?

The WooCommerce Multi Currency plugin for WordPress contains a vulnerability that allows authenticated attackers with subscriber-level permissions or higher to bypass authorization checks. This weakness arises from a missing capability check in the wmc_bulk_fixed_price function, enabling unauthorized modifications to product prices. The flaw affects versions up to and including 2.1.17, posing a risk of unapproved price adjustments that could disrupt store integrity.

References