The RealMag777 FOX woocommerce‑currency‑switcher plugin contains a flaw where user input is not properly sanitized before inclusion in an SQL query, creating a blind SQL injection vulnerability. The flaw enables an attacker to send specially crafted requests to the plugin’s processing endpoint and read or modify data stored in the WordPress database. The attack vector is inferred to be remote, via the web interface that the plugin exposes.

All WordPress installations that use the FOX plugin version 1.4.5 or older are affected. The vulnerability is present in every release from the initial build through version 1.4.5, regardless of earlier or later minor releases within that range.

The CVSS score of 7.6 indicates a high severity flaw, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation does not require elevated privileges on the host; an attacker only needs the ability to send crafted HTTP requests to the vulnerable plugin endpoint. Successful exploitation could allow unauthorized reading or alteration of WordPress database contents.