CVE-2024-8271: FOX Currency Switcher WooCommerce RCE Flaw

CVE-2024-8271 Overview

CVE-2024-8271 affects the FOX – Currency Switcher Professional for WooCommerce plugin for WordPress. All versions up to and including 1.4.2.1 permit unauthenticated arbitrary shortcode execution. The flaw resides in the woocs_get_custom_price_html function, which calls do_shortcode on user-supplied input without proper validation. Remote attackers can invoke any shortcode registered on the target site without authentication. The vulnerability is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Unauthenticated attackers can execute arbitrary WordPress shortcodes through the woocs_get_custom_price_html function, potentially exposing sensitive data or triggering unintended plugin behavior on vulnerable sites.

Affected Products

Pluginus FOX – Currency Switcher Professional for WooCommerce versions through 1.4.2.1
WordPress installations with the WooCommerce Currency Switcher plugin enabled
WooCommerce storefronts relying on the vulnerable plugin for price localization

Discovery Timeline

2024-09-14 - CVE-2024-8271 published to NVD
2024-09-27 - Last updated in NVD database

Technical Details for CVE-2024-8271

Vulnerability Analysis

The vulnerability stems from unsafe handling of user input inside the woocs_get_custom_price_html function of the FOX Currency Switcher plugin. The function passes attacker-controlled values directly to the WordPress do_shortcode API without validating that the input matches an expected price-related shortcode. Because the affected action does not require authentication, any remote user can submit crafted requests that trigger shortcode parsing. WordPress shortcodes can perform diverse actions including database queries, file inclusion, and rendering of protected content. Exploitation outcomes depend on which shortcodes are registered on the target site, including those introduced by other installed plugins and themes.

Root Cause

The root cause is missing input validation before invocation of do_shortcode. Source code for the vulnerable handler is available in the WordPress Plugin Code Reference. The plugin trusts the supplied parameter as a price-formatting string when it should restrict execution to a whitelist of safe shortcode tags. This pattern maps to CWE-94: Improper Control of Generation of Code (Code Injection).

Attack Vector

An unauthenticated attacker sends an HTTP request to the WordPress site invoking the vulnerable action and supplies a shortcode payload in the parameter consumed by woocs_get_custom_price_html. The plugin then evaluates the shortcode server-side. Attackers can chain this primitive with other shortcode-driven plugins to disclose information, enumerate users, or trigger administrative functionality exposed through shortcodes. The attack requires no user interaction and no privileges. Technical details and exploitation context are documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-8271

Indicators of Compromise

HTTP requests to admin-ajax.php or front-end endpoints referencing the woocs_get_custom_price_html action with shortcode syntax such as [...] inside request parameters
Unexpected shortcode output rendered in HTTP responses originating from the WooCommerce Currency Switcher plugin
Web server logs showing high volumes of POST or GET requests targeting WooCommerce currency switcher endpoints from a single source

Detection Strategies

Inspect WordPress access logs for parameter values containing square-bracket shortcode markers sent to FOX Currency Switcher endpoints
Deploy web application firewall (WAF) rules that block square-bracket payloads in request parameters consumed by woocs_get_custom_price_html
Audit installed plugin versions and flag any host running FOX Currency Switcher Professional for WooCommerce at 1.4.2.1 or earlier

Monitoring Recommendations

Centralize WordPress, PHP, and web server logs into a SIEM or data lake for correlation across plugin-related events
Alert on anomalous spikes of unauthenticated traffic targeting WooCommerce AJAX actions
Track outbound network connections from the WordPress host that follow inbound requests to the vulnerable endpoint

How to Mitigate CVE-2024-8271

Immediate Actions Required

Update the FOX – Currency Switcher Professional for WooCommerce plugin to a version newer than 1.4.2.1 as soon as a fixed release is available
Restrict access to the WordPress admin and AJAX endpoints using IP allow-listing where feasible
Review installed plugins and themes to inventory shortcodes that could be abused if invoked by an unauthenticated attacker

Patch Information

The vendor pushed a fix through the WordPress plugin repository. Refer to the WordPress Change Log Update for the committed changes and validate the deployed plugin version in the WordPress admin dashboard.

Workarounds

Disable the FOX – Currency Switcher Professional for WooCommerce plugin until the patched version is installed
Apply WAF rules that strip or block shortcode syntax in parameters destined for the vulnerable handler
Remove or restrict registration of high-impact shortcodes from other plugins that could be reached via this vector

bash

# Example WAF rule (ModSecurity) to block shortcode payloads on the vulnerable action
SecRule ARGS "@rx \[[a-zA-Z0-9_\-]+" \
  "id:1008271,phase:2,deny,status:403,\
  msg:'CVE-2024-8271 FOX Currency Switcher shortcode injection attempt',\
  chain"
  SecRule ARGS:action "@streq woocs_get_custom_price_html"