CVE-2026-4094

The FOX – Currency Switcher Professional plugin for WooCommerce has a security flaw that allows unauthorized data loss. Specifically, an attacker with Contributor-level access or above can delete the entire multi-currency configuration by visiting any WordPress admin page with a specific parameter appended. This vulnerability can also be exploited through a Cross-Site Request Forgery attack against an administrator, and in some cases, even by a Subscriber-level user if they have access to admin pages.

Based on public CVE data (MITRE/NVD).