The WordPress FOX plugin contains a missing authorization flaw that lets attackers alter the WooCommerce Currency Switcher configuration on affected installations. By modifying currency display settings, an attacker can disrupt e‑commerce transactions and damage customer trust. The issue is confined to plugin versions 1.5.4 and earlier.

The vulnerability affects all WordPress sites that have the FOX plugin for WooCommerce Currency Switcher installed at version 1.5.4 or older. These sites, typically managed through the PluginUs.Net vendor, have not yet applied the mandatory update to at least version 1.5.5.

The CVSS score of 5.3 indicates medium severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalogue, so exploitation probability remains uncertain. The likely attack vector is via the web interface of the WordPress admin panel, as the flaw is a broken access control; anyone with a valid account that can reach the plugin settings can exploit the weakness to alter currency configuration, potentially causing financial disruption.