CVE-2026-108174

MediumCVSS 5.3

Published: 13/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The FOX (woocommerce-currency-switcher) plugin up to version 1.5.4 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain access to functions that should be protected.

Risk Assessment

The risk includes unauthorized access to administrative functions or sensitive data, potentially leading to system integrity compromise and data theft. It may also enable further attacks on the infrastructure.

Recommendation

It is recommended to update the FOX plugin to the latest version that fixes this vulnerability. Also, review permission configuration and restrict access to necessary functions.

Other vulnerabilities in FOX

CVE-2026-57319High
An unauthenticated Cross Site Scripting (XSS) vulnerability exists in FOX versions 1.4.8 and earlier. It allows a remote attacker to inject malicious script without authentication.

Original NVD description (English source)

Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS