The FOX – Currency Switcher Professional for WooCommerce plugin contains a missing capability check on the admin_head function, a Missing Authorization flaw (CWE-862), allowing authenticated users with Contributor level or higher to delete the entire multi‑currency configuration. Because the code does not validate a nonce, the mechanism can be invoked via Cross‑Site Request Forgery against administrators. If the site permits Subscriber access to wp‑admin pages, even lower‑privileged users could exploit the flaw. The result is loss of configuration data and potential service interruption for sites relying on the plugin’s currency settings.

All installations of the FOX – Currency Switcher Professional for WooCommerce plugin running version 1.4.5 or earlier on WordPress sites are affected. The vendor is Realmag777.

The vulnerability has a CVSS score of 8.1, indicating high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The attack path requires authenticated access to the wp‑admin area; an attacker with Contributor privileges can trigger the reset by adding the woocs_reset parameter to any admin URL, or an admin can be victimized via CSRF. The potential impact is data loss and service disruption. Given the high score and the need for user authentication, the risk is considerable for sites where contributors or subscribers have admin‑area access.