Unauthorized Data Loss Vulnerability in FOX – Currency Switcher Professional for WooCommerce by WordPress

CVE-2026-4094

What is CVE-2026-4094?

The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is susceptible to unauthorized data loss due to a missing capability check in the 'admin_head' function. This vulnerability affects all versions up to and including 1.4.5. Authenticated attackers with Contributor-level access can exploit this flaw to delete the multi-currency configuration by accessing any wp-admin page with the woocs_reset parameter. Moreover, the absence of nonce verification allows Cross-Site Request Forgery attacks against administrators. It's additionally noteworthy that if the site configuration permits, Subscriber-level users can also exploit this vulnerability.

References