CVE-2026-4094: realmag777 fox – currency switcher professional for woocommerce Missing Authorization

Vulnerability summary

CVE-2026-4094 is a high (CVSS 8.1) Missing Authorization vulnerability in realmag777 fox – currency switcher professional for woocommerce. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 42.1% of scored vulnerabilities. Fixed in 1.4.6.

Timeline

1. 15-05-2026
   PublishedVulnerability first disclosed.
2. 15-05-2026
   Last modifiedVulnerability information updated.

Description

The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'admin_head' function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete the entire multi-currency configuration by visiting any wp-admin page with the `woocs_reset` parameter appended. Additionally, because no nonce is verified, this is also exploitable via Cross-Site Request Forgery against any administrator. The vulnerability may also be exploited by Subscriber-level users if the site is configured to allow Subscriber access to 'wp-admin' pages.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.