Missing Authorization in PluginUs.Net's FOX WooCommerce Currency Switcher
CVE-2026-123461

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Fox
Vendor
CVE Published:
7 November 2026

What is CVE-2026-123461?

The FOX WooCommerce Currency Switcher plugin by PluginUs.Net contains a vulnerability due to missing authorization, which allows unauthorized users to exploit improperly configured access control settings. This issue affects all versions from n/a to 1.5.6, potentially enabling malicious actors to gain unnecessary privileges and perform actions without proper authentication.

Affected Version(s)

FOX 0 <= 1.5.6

References

https://patchstack.com/database/wordpress/plugin/woocomme...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

nizar yart (D3dC0d) | Patchstack Bug Bounty Program
.