---
id: "CVE-2026-124409"
page: "https://infrastack.ai/live/CVE-2026-124409"
kind: "vulnerability"
aliases: ["CVE-2026-124409"]
title: "CURCY WooCommerce multi-currency plugin: missing authorization check exposes access controls"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "woo-multi-currency", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-13T15:17:36+00:00"
first_seen_at: "2026-11-13T15:46:16+00:00"
updated_at: "2026-11-13T15:50:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124409", "first_seen_at": "2026-11-13T15:46:16+00:00"}]
exploit_sources: []
---

# CURCY WooCommerce multi-currency plugin: missing authorization check exposes access controls

Link for people: https://infrastack.ai/live/CVE-2026-124409 (this .md is for agents)

The CURCY multi-currency plugin for WooCommerce is missing an authorization check, so access control can be bypassed through misconfigured permission levels. The description says affected versions run through 2.2.21, and the sources give no further detail on what an attacker can read or change.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CURCY (woo-multi-currency) plugin version in the WordPress admin under Plugins, or in the plugin header of `woo-multi-currency.php`.
- Treat any site running a version up to and including `2.2.21` as in scope.

## Timeline

- 2026-11-13T15:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124409

## From the sources

Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.21.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_