{"id":"CVE-2026-124409","kind":"vulnerability","aliases":["CVE-2026-124409"],"related":[],"title":"CURCY WooCommerce multi-currency plugin: missing authorization check exposes access controls","description":"Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.21.","summary":"The CURCY multi-currency plugin for WooCommerce is missing an authorization check, so access control can be bypassed through misconfigured permission levels. The description says affected versions run through 2.2.21, and the sources give no further detail on what an attacker can read or change.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","woo-multi-currency","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed CURCY (woo-multi-currency) plugin version in the WordPress admin under Plugins, or in the plugin header of `woo-multi-currency.php`.\n- Treat any site running a version up to and including `2.2.21` as in scope.","fix":null,"status":"open","published_at":"2026-11-13T15:17:36+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","triaged_at":"2026-11-13T15:50:05+00:00","updated_at":"2026-11-13T15:50:05+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T15:50:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"CURCY WooCommerce multi-currency plugin: missing authorization check exposes access controls","impact":"medium","summary":"The CURCY multi-currency plugin for WooCommerce is missing an authorization check, so access control can be bypassed through misconfigured permission levels. The description says affected versions run through 2.2.21, and the sources give no further detail on what an attacker can read or change.","audience":"businesses","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","woo-multi-currency"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Find the vendor advisory or Wordfence/NVD detail to confirm the affected endpoint, required privilege, and whether a fixed version above 2.2.21 exists.","how_to_check":"- Check the installed CURCY (woo-multi-currency) plugin version in the WordPress admin under Plugins, or in the plugin header of `woo-multi-currency.php`.\n- Treat any site running a version up to and including `2.2.21` as in scope.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the CURCY (woo-multi-currency) WooCommerce plugin from VillaTheme at or below 2.2.21 are in scope. The sources do not describe which endpoints or roles are involved, so whether anonymous users can reach the flaw is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00074,"input_tokens":4543,"output_tokens":572,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124409':15A,18A '-2026':14A,17A '2.2.21':56B,96C 'access':11A,40B,86C 'affect':52B,91C 'allow':82C 'attack':67B 'author':8A,37B,73C 'bypass':44B 'chang':71B 'check':9A,38B 'configur':85C 'control':12A,41B,87C 'curci':1A,27B,77C,92C 'currenc':5A,23B,30B,81C 'cve':13A,16A 'descript':50B 'detail':63B 'exploit':83C 'expos':10A 'give':60B 'incorrect':84C 'issu':90C 'level':48B 'levels.this':89C 'misconfigur':46B 'miss':7A,35B,72C 'multi':4A,22B,29B,80C 'multi-curr':3A,28B 'n/a':94C 'packag':19B 'permiss':47B 'plugin':6A,31B 'read':69B 'run':54B 'say':51B 'secur':88C 'sourc':59B 'version':53B 'villathem':76C 'vulner':74C 'woo':21B,79C 'woo-multi-curr':20B,78C 'woocommerc':2A,24B,33B 'wordpress':25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the CURCY (woo-multi-currency) WooCommerce plugin from VillaTheme at or below 2.2.21 are in scope. The sources do not describe which endpoints or roles are involved, so whether anonymous users can reach the flaw is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","woocommerce","woomulticurrency","wordpress"],"campaign_type":null,"search_a":"'-124409':15A,18A '-2026':14A,17A 'access':11A 'author':8A 'check':9A 'control':12A 'curci':1A 'currenc':5A 'cve':13A,16A 'expos':10A 'miss':7A 'multi':4A 'multi-curr':3A 'plugin':6A 'woocommerc':2A","search_b":"'2.2.21':56B 'access':40B 'affect':52B 'attack':67B 'author':37B 'bypass':44B 'chang':71B 'check':38B 'control':41B 'curci':27B 'currenc':23B,30B 'descript':50B 'detail':63B 'give':60B 'level':48B 'misconfigur':46B 'miss':35B 'multi':22B,29B 'multi-curr':28B 'packag':19B 'permiss':47B 'plugin':31B 'read':69B 'run':54B 'say':51B 'sourc':59B 'version':53B 'woo':21B 'woo-multi-curr':20B 'woocommerc':24B,33B 'wordpress':25B","search_c":"'2.2.21':96C 'access':86C 'affect':91C 'allow':82C 'author':73C 'configur':85C 'control':87C 'curci':77C,92C 'currenc':81C 'exploit':83C 'incorrect':84C 'issu':90C 'levels.this':89C 'miss':72C 'multi':80C 'n/a':94C 'secur':88C 'villathem':76C 'vulner':74C 'woo':79C 'woo-multi-curr':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124409","severity":null,"published_at":"2026-11-13T15:17:36+00:00","modified_at":"2026-11-13T15:17:36+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","fetched_at":"2026-11-13T15:46:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}