CVE-2024-30458: WooCommerce Currency Switcher CSRF Flaw

CVE-2024-30458 Overview

CVE-2024-30458 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the realmag777 WOOCS – WooCommerce Currency Switcher plugin for WordPress, also known as Pluginus Fox - Currency Switcher Professional For WooCommerce. The flaw impacts all versions up to and including 1.4.1.7. An attacker can trick an authenticated administrator into submitting forged requests that perform privileged actions on the WordPress site. Successful exploitation can compromise confidentiality, integrity, and availability of the affected store.

Critical Impact
Authenticated administrator interaction with an attacker-controlled page can lead to unauthorized state-changing actions on the WooCommerce site, with high impact across confidentiality, integrity, and availability.

Affected Products

Pluginus Fox - Currency Switcher Professional For WooCommerce (WOOCS) versions up to 1.4.1.7
WordPress sites running the affected plugin with WooCommerce
Any e-commerce deployment relying on the vulnerable plugin for multi-currency support

Discovery Timeline

2024-03-29 - CVE-2024-30458 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2024-30458

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery weakness in the WOOCS – WooCommerce Currency Switcher plugin. The plugin fails to validate request authenticity for sensitive state-changing actions. As a result, requests originating from third-party domains can be processed as if they were issued by a legitimate authenticated user. The attack requires user interaction, typically an administrator visiting a malicious page while logged in to WordPress. According to the EPSS model, the probability of observed exploitation is approximately 0.241%.

Root Cause

The root cause is the absence or improper validation of anti-CSRF tokens, commonly implemented in WordPress through the wp_nonce_field() and check_admin_referer() APIs. Without nonce verification, the plugin cannot distinguish requests submitted from its own admin UI from those forged on attacker-controlled sites. The handler executes the requested action based solely on the victim's session cookies.

Attack Vector

An attacker hosts a crafted HTML page containing an auto-submitting form or image tag that targets a vulnerable plugin endpoint. When an authenticated WordPress administrator visits the page, the browser automatically attaches session cookies to the cross-origin request. The plugin processes the forged request and applies attacker-supplied parameters. The attack vector is network-based, requires no privileges from the attacker, and depends on user interaction. See the Patchstack Vulnerability Database Entry for additional technical context.

Detection Methods for CVE-2024-30458

Indicators of Compromise

Unexpected modifications to WOOCS plugin settings, currency configurations, or exchange rates without corresponding admin activity in audit logs.
HTTP POST requests to plugin endpoints with Referer headers pointing to external or unfamiliar domains.
Administrator sessions generating requests immediately after visiting third-party links.

Detection Strategies

Inspect web server access logs for POST requests to WOOCS plugin URLs lacking a same-origin Referer or missing nonce parameters.
Compare the plugin version installed against 1.4.1.7 and earlier using WordPress plugin inventory tooling.
Review WordPress audit logs for configuration changes that do not align with administrator activity patterns.

Monitoring Recommendations

Enable a WordPress audit logging plugin to record changes to plugin settings and user actions.
Monitor for anomalous outbound traffic from administrator browsers to unknown domains preceding configuration changes.
Alert on plugin file modifications and on creation of new administrator accounts following suspicious admin browsing activity.

How to Mitigate CVE-2024-30458

Immediate Actions Required

Update the WOOCS – WooCommerce Currency Switcher plugin to a version later than 1.4.1.7 as soon as a patched release is available from the vendor.
Audit administrator accounts and recent plugin configuration changes for unauthorized modifications.
Require administrators to log out of WordPress before browsing untrusted sites, and enforce separate browser profiles for administrative work.

Patch Information

Review the Patchstack Vulnerability Database Entry for vendor patch status and upgrade guidance. Apply the latest vendor-supplied version that resolves the CSRF defect.

Workarounds

Deploy a Web Application Firewall (WAF) rule to block cross-origin POST requests to WOOCS plugin endpoints lacking a valid Referer or WordPress nonce.
Restrict access to /wp-admin/ by IP allowlist where operationally feasible.
Enforce the SameSite=Lax or SameSite=Strict attribute on WordPress authentication cookies to reduce CSRF exposure.

bash

# Example nginx rule to block cross-origin admin POSTs to the plugin
location ~* /wp-admin/admin-ajax\.php$ {
    if ($http_referer !~* "^https?://your-domain\.com") {
        return 403;
    }
}