Now officially on WordPress.org

CVE Database / CVE-2026-39501

CVE · Medium

CVE-2026-39501 — FOX – Currency Switcher Professional for WooCommerce [woocommerce-currency-switcher] < 1.4.6

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-39501 FOX – Currency Switcher Professional for WooCommerce [woocommerce-currency-switcher] < 1.4.6 — Medium 5.3 < 1.4.6 1.4.6 2026-03-27 —

CVE-2026-39501

A flaw exists in the FOX plugin for WordPress, where a critical security oversight has been discovered in its authorization mechanism. Specifically, a capability check is absent from a key function within versions of the plugin up to 1.4.5, allowing malicious actors without authentication to execute actions they shouldn't be able to perform.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings