CVE-2026-39501

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

The FOX woocommerce-currency-switcher plugin for WordPress up to version 1.4.5 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Risk Assessment

Unauthorized users can change currency switcher settings, potentially leading to price manipulation or other damage.

Recommendation

Update the FOX plugin to the latest version or apply temporary mitigations (e.g., restrict admin panel access).

Original NVD description (English source)

Missing Authorization vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through <= 1.4.5.