CVE-2026-9241 PUBLISHED

FOX – Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter

Assigner: Wordfence
Reserved: 21.05.2026 Published: 28.05.2026 Updated: 28.05.2026

The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 1.4.6. This is due to the get_value() function in classes/fixed/fixed_user_role.php trusting the attacker-controlled $_REQUEST['wooc_order_user_roles'] parameter to determine the user's role context for role-based price resolution without any validation, allowing it to override the legitimate role data derived from the authenticated user's session object via $user->roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate higher-privileged roles — such as wholesale customer or administrator — and obtain discounted or otherwise restricted pricing that should not be available to their actual role. This vulnerability only has practical impact when the fixed user-role pricing feature is enabled and at least one product has a privileged-role price configured.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 4.3

Product Status

Vendor realmag777
Product FOX – Currency Switcher Professional for WooCommerce
Versions Default: unaffected
  • affected from 0 to 1.4.6 (incl.)

Credits

  • Long Lagon finder

References

Problem Types

  • CWE-639 Authorization Bypass Through User-Controlled Key CWE