The vulnerability is a missing authorization flaw in the RealMag777 FOX WooCommerce‑Currency‑Switcher plugin, allowing attackers to execute privileged functions that should be restricted. The problem manifests as broken access control, potentially letting an attacker gain administrative capabilities within the plugin’s settings or data. This weakness corresponds to CWE‑862: Missing Authorization, and could lead to unauthorized viewing or manipulation of currency switcher configurations, affecting the integrity and availability of e‑commerce operations.

The affected product is the RealMag777 FOX plugin for WordPress WooCommerce, versions up to and including 1.4.5. Users running any of these versions are vulnerable.

The CVSS score of 5.3 indicates a medium severity, with an EPSS score of less than 1% suggesting that active exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely occur via web requests to administrative endpoints exposed by the plugin, potentially without additional prerequisites beyond web access. Attackers could leverage this flaw to bypass normal authorization checks and perform restricted actions remotely.