PatchSiren cyber security CVE debrief
CVE-2026-9241 realmag777 CVE debrief
A medium-severity authorization bypass vulnerability in the FOX – Currency Switcher Professional for WooCommerce plugin allows authenticated attackers with Subscriber-level access or higher to impersonate privileged roles and obtain unauthorized pricing. The flaw exists in the `get_value()` function within `classes/fixed/fixed_user_role.php`, which trusts the attacker-controlled `$_REQUEST['wooc_order_user_roles']` parameter without validation to determine role context for price resolution. This permits overriding legitimate role data from the authenticated user's session. The vulnerability is exploitable only when the fixed user-role pricing feature is enabled and at least one product has privileged-role pricing configured. The issue affects all versions up to and including 1.4.6. The vulnerability was disclosed on 2026-05-28 and carries a CVSS 3.1 score of 4.3 (Medium).
- Vendor
- realmag777
- Product
- FOX – Currency Switcher Professional for WooCommerce
- CVSS
- MEDIUM 4.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-28
- Original CVE updated
- 2026-05-28
- Advisory published
- 2026-05-28
- Advisory updated
- 2026-05-28
Who should care
WordPress site administrators running FOX – Currency Switcher Professional for WooCommerce with role-based pricing enabled; WooCommerce store operators with tiered pricing structures; security teams monitoring for pricing integrity violations in e-commerce platforms
Technical summary
The vulnerability stems from insufficient input validation in the role-based pricing resolution mechanism. The `get_value()` function directly consumes `$_REQUEST['wooc_order_user_roles']` to establish role context, bypassing the authoritative `$user->roles` data from the authenticated session. This architectural weakness enables client-side role specification, violating the security principle that privilege context must be server-authoritative. The attack surface is constrained by the requirement for authenticated access and the prerequisite configuration state (fixed user-role pricing enabled with differential pricing configured).
Defensive priority
medium
Recommended defensive actions
- Update FOX – Currency Switcher Professional for WooCommerce to version 1.4.7 or later
- If immediate patching is not possible, disable the fixed user-role pricing feature until the update can be applied
- Review WooCommerce order logs for anomalous pricing requests that may indicate exploitation attempts
- Implement Web Application Firewall rules to detect and block requests containing manipulated wooc_order_user_roles parameters
- Audit product configurations to identify any privileged-role pricing that could be targeted by this vulnerability
Evidence notes
Vulnerability confirmed via Wordfence security advisory and WordPress plugin repository source code analysis. The vulnerable code path is documented at lines 228-229 of fixed_user_role.php, with the request parameter handling visible at line 2271 of woocs.php. A changeset is available showing remediation activity.
Official resources
2026-05-28