{"id":"CVE-2026-123461","kind":"vulnerability","aliases":["CVE-2026-123461"],"related":[],"title":"WooCommerce currency switcher plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.6.","summary":"The FOX woocommerce-currency-switcher WordPress plugin, through version 1.5.6, lacks an authorization check on some functionality. An attacker may be able to use actions their account should not be allowed to perform.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","plugin","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the FOX woocommerce-currency-switcher plugin in the WordPress admin plugin list or in its plugin header.\n- Confirm whether the installed version is `1.5.6` or earlier.","fix":null,"status":"open","published_at":"2026-11-07T18:17:20+00:00","first_seen_at":"2026-11-07T18:48:29+00:00","triaged_at":"2026-11-07T18:50:04+00:00","updated_at":"2026-11-07T18:50:04+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T18:50:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"WooCommerce currency switcher plugin: missing authorization check exposes access controls","impact":"medium","summary":"The FOX woocommerce-currency-switcher WordPress plugin, through version 1.5.6, lacks an authorization check on some functionality. An attacker may be able to use actions their account should not be allowed to perform.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","plugin"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may perform restricted actions on the store","analyst_note":"Check the NVD entry and the Wordfence or vendor advisory for the affected functions, required privilege, and a fixed version.","how_to_check":"- Check the installed version of the FOX woocommerce-currency-switcher plugin in the WordPress admin plugin list or in its plugin header.\n- Confirm whether the installed version is `1.5.6` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the FOX woocommerce-currency-switcher plugin at version 1.5.6 or earlier are in scope, since the affected range runs from n/a through 1.5.6. The sources do not say which roles or endpoints are affected, so teams should check whether the plugin is installed at all. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000699,"input_tokens":4221,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123461':13A,16A '-2026':12A,15A '1.5.6':31B,79C 'abl':43B 'access':9A,69C 'account':48B 'action':46B 'affect':74C 'allow':52B,65C 'attack':40B 'author':6A,34B,56C 'check':7A,35B 'configur':68C 'control':10A,70C 'currenc':2A,25B,63C 'cve':11A,14A 'exploit':66C 'expos':8A 'fox':22B,60C,75C 'function':38B 'incorrect':67C 'issu':73C 'lack':32B 'levels.this':72C 'may':41B 'miss':5A,55C 'n/a':77C 'packag':17B 'perform':54B 'plugin':4A,18B,28B 'pluginus.net':59C 'secur':71C 'switcher':3A,26B,64C 'use':45B 'version':30B 'vulner':57C 'woocommerc':1A,19B,24B,62C 'woocommerce-currency-switch':23B,61C 'wordpress':20B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the FOX woocommerce-currency-switcher plugin at version 1.5.6 or earlier are in scope, since the affected range runs from n/a through 1.5.6. The sources do not say which roles or endpoints are affected, so teams should check whether the plugin is installed at all. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","plugin","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-123461':13A,16A '-2026':12A,15A 'access':9A 'author':6A 'check':7A 'control':10A 'currenc':2A 'cve':11A,14A 'expos':8A 'miss':5A 'plugin':4A 'switcher':3A 'woocommerc':1A","search_b":"'1.5.6':31B 'abl':43B 'account':48B 'action':46B 'allow':52B 'attack':40B 'author':34B 'check':35B 'currenc':25B 'fox':22B 'function':38B 'lack':32B 'may':41B 'packag':17B 'perform':54B 'plugin':18B,28B 'switcher':26B 'use':45B 'version':30B 'woocommerc':19B,24B 'woocommerce-currency-switch':23B 'wordpress':20B,27B","search_c":"'1.5.6':79C 'access':69C 'affect':74C 'allow':65C 'author':56C 'configur':68C 'control':70C 'currenc':63C 'exploit':66C 'fox':60C,75C 'incorrect':67C 'issu':73C 'levels.this':72C 'miss':55C 'n/a':77C 'pluginus.net':59C 'secur':71C 'switcher':64C 'vulner':57C 'woocommerc':62C 'woocommerce-currency-switch':61C","first_public_at":"2026-11-07T18:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123461","severity":null,"published_at":"2026-11-07T18:17:20+00:00","modified_at":"2026-11-07T18:17:20+00:00","first_seen_at":"2026-11-07T18:48:29+00:00","fetched_at":"2026-11-07T18:48:29+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}