The FOX – Currency Switcher Professional for WooCommerce plugin is vulnerable to an authorization bypass that allows an authenticated user with Subscriber or higher access to manipulate the `wooc_order_user_roles` request parameter. The plugin’s `get_value()` function trusts this user‑controlled key without validation, letting the attacker override the role information normally derived from the session. As a result, an attacker can elevate privileges to roles such as wholesale customer or administrator and access pricing that is reserved for those roles. The vulnerability only affects configurations where the fixed user‑role pricing feature is enabled and at least one product has a privileged‑role price.

realmag777’s FOX – Currency Switcher Professional for WooCommerce plugin for WordPress, versions up to and including 1.4.6.

The risk is moderate, with a CVSS score of 4.3. Because the vulnerability requires an authenticated user, the attack surface is limited to legitimate users with Subscriber access or higher. The EPSS score is not available, but on the basis that the flaw affects only a specific plugin module and no broader codebase, the likelihood of widespread exploitation is low. The attacker would craft an HTTP request containing the `wooc_order_user_roles` parameter to override the internal role calculation. Since there is no existing CISA KEV listing, the vulnerability is not known to have been exploited in the wild.