Authorization Bypass in FOX – Currency Switcher Professional for WooCommerce

CVE-2026-9241

What is CVE-2026-9241?

The FOX – Currency Switcher Professional for WooCommerce plugin allows an authorization bypass due to improper validation of user roles. Specifically, the get_value() function leverages a user-controlled parameter, allowing authenticated attackers with low-level access to impersonate users with higher privileges. This results in the possibility of accessing restricted pricing and discounts that should normally be reserved for higher roles such as wholesale customers or administrators. This vulnerability is particularly concerning when products are configured with privilege-based pricing features.

References