FOX Currency Switcher Professional for WooCommerce Missing Authorization Vulnerability Allowing Configuration Deletion

A vulnerability exists in the FOX – Currency Switcher Professional for WooCommerce plugin for WordPress, in all versions through 1.4.5. The issue arises from a missing capability check on the 'admin_head' function, allowing authenticated attackers with Contributor-level access and above to delete the entire multi-currency configuration. This can be done by visiting any wp-admin page with the 'woocs_reset' parameter appended. The absence of nonce verification also makes this vulnerability exploitable via Cross-Site Request Forgery (CSRF) against any administrator. Additionally, if a site allows Subscriber access to wp-admin pages, this vulnerability could be exploited by users with Subscriber-level access.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of the multi-currency configuration, potentially disrupting e-commerce operations that rely on currency management.

Remediation

Users are advised to update the plugin to version 1.4.6 or a newer patched version.