What the vulnerability does
01Description
The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'admin_head' function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete the entire multi-currency configuration by visiting any wp-admin page with the `woocs_reset` parameter appended. Additionally, because no nonce is verified, this is also exploitable via Cross-Site Request Forgery against any administrator. The vulnerability may also be exploited by Subscriber-level users if the site is configured to allow Subscriber access to 'wp-admin' pages.
Explanation of Vulnerability in Simple Terms
02Summary
FOX – Currency Switcher Professional for WooCommerce versions 1.4.5 and earlier lack proper authorization checks, allowing authenticated users with low privileges to modify or delete critical site data. An attacker with a basic user account can change store settings, product information, or disable core functionality without permission. Update to a version newer than 1.4.5 immediately.
What an attacker can do
03Attacker Capabilities
Modify or delete store settings and product data without proper authorization.
Potential impact on your site
04Site Impact
Store configuration, pricing, and product data can be altered or destroyed by any logged-in user.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account (e.g., subscriber or customer role).
Key dates
06Disclosure timeline
May 15, 2026
CVE published
May 15, 2026
Record updated
