CVE-2026-108174: FOX Currency Switcher Auth Bypass Flaw

CVE-2026-108174 Overview

CVE-2026-108174 is a Missing Authorization vulnerability [CWE-862] affecting the PluginUs.Net FOX woocommerce-currency-switcher plugin for WordPress. The flaw stems from incorrectly configured access control security levels, allowing unauthenticated attackers to reach functionality that should require authorization. The issue affects FOX versions from the earliest release through 1.5.4. According to the Patchstack Vulnerability Report, exploitation requires no authentication or user interaction and can be performed remotely over the network. Successful exploitation results in a limited integrity impact without affecting confidentiality or availability.

Critical Impact

Unauthenticated remote attackers can invoke protected plugin functionality on WooCommerce stores running vulnerable versions of the FOX currency switcher, resulting in unauthorized modification of plugin-controlled data.

Affected Products

• PluginUs.Net FOX woocommerce-currency-switcher plugin for WordPress
• All versions from initial release through 1.5.4
• WooCommerce stores running the FOX currency switcher plugin

Discovery Timeline

• 2026-10-13 - CVE-2026-108174 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108174

Vulnerability Analysis

The FOX woocommerce-currency-switcher plugin exposes functionality without enforcing proper authorization checks. Under CWE-862: Missing Authorization, the application fails to verify that a requesting user has the required permissions before executing a sensitive action. In the context of a WordPress plugin, this typically manifests through AJAX endpoints, REST routes, or admin-post handlers that lack current_user_can() capability checks or nonce validation. An unauthenticated attacker reaching these endpoints can trigger state changes that should be restricted to administrators or shop managers. The EPSS score of 0.184% indicates a low current probability of mass exploitation, but the public disclosure and simple attack prerequisites make targeted abuse straightforward.

Root Cause

The plugin registers handlers that process requests without validating the caller's role or capability. Access control decisions are either absent or depend on client-controlled values, matching the Patchstack classification of a broken access control vulnerability. The condition persists across all releases up to and including version 1.5.4.

Attack Vector

The attack is executed over the network against the vulnerable WordPress site. An attacker crafts an HTTP request to the exposed plugin endpoint and receives the response that would normally be restricted. No credentials, interaction, or elevated privileges are required. Refer to the Patchstack advisory for technical specifics on the affected endpoint.

Detection Methods for CVE-2026-108174

Indicators of Compromise

• Unauthenticated POST or GET requests to WooCommerce currency switcher plugin endpoints under /wp-admin/admin-ajax.php or REST routes exposed by the plugin
• Unexpected modifications to currency, exchange rate, or plugin configuration values without a corresponding administrator login event
• Elevated request volume from a single external IP targeting FOX plugin action parameters

Detection Strategies

• Inventory WordPress installations and identify sites running woocommerce-currency-switcher version 1.5.4 or earlier
• Monitor web server access logs for anonymous requests to plugin AJAX actions containing the fox or woocs action prefix
• Deploy web application firewall rules to flag unauthenticated calls to WooCommerce plugin administrative actions

Monitoring Recommendations

• Alert on changes to WordPress options tables correlated with requests from non-authenticated sessions
• Correlate plugin configuration change events with originating IP reputation and geographic baselines
• Enable WordPress audit logging to capture plugin setting modifications in near real time

How to Mitigate CVE-2026-108174

Immediate Actions Required

• Upgrade the FOX woocommerce-currency-switcher plugin to a version released after 1.5.4 once published by PluginUs.Net
• Restrict administrative access to WordPress endpoints using IP allowlisting at the web server or WAF layer
• Review WordPress audit logs for unauthorized plugin configuration changes dating back to plugin installation

Patch Information

At publication, the vendor had not released a fixed version documented in the NVD entry. Consult the Patchstack Vulnerability Report and the PluginUs.Net plugin changelog for the latest remediation status. If no patched release is available, disable the plugin until a fix is published.

Workarounds

• Deactivate the FOX woocommerce-currency-switcher plugin until a patched version is available
• Block external access to plugin AJAX endpoints via .htaccess or Nginx location rules where feasible
• Apply virtual patching through a WordPress security plugin or WAF that enforces authentication on vulnerable action handlers

# Nginx example: block unauthenticated access to WordPress admin-ajax actions targeting the plugin
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^(woocs|fox)_") {
        set $block_request 1;
    }
    if ($http_cookie !~* "wordpress_logged_in_") {
        set $block_request "${block_request}1";
    }
    if ($block_request = "11") {
        return 403;
    }
}