https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 09:47:19 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-322341 EUVD-2026-322341 https://cve.radiocsirt.org/vuln/euvd-2026-322341 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9241 <p>The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 1.4.6. This is due to the `get_value()` function in `classes/fixed/fixed_user_role.php` trusting the attacker-controlled `$_REQUEST[&#39;wooc_order_user_roles&#39;]` parameter to determine the user&#39;s role context for role-based price resolution without any validation, allowing it to override the legitimate role data derived from the authenticated user&#39;s session object via `$user-&gt;roles`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate higher-privileged roles — such as wholesale customer or administrator — and obtain discounted or otherwise restricted pricing that should not be available to their actual role. This vulnerability only has practical impact when the fixed user-role pricing feature is enabled and at least one product has a privileged-role price configured.</p> <p>The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 1.4.6. This is due to the `get_value()` function in `classes/fixed/fixed_user_role.php` trusting the attacker-controlled `$_REQUEST[&#39;wooc_order_user_roles&#39;]` parameter to determine the user&#39;s role context for role-based price resolution without any validation, allowing it to override the legitimate role data derived from the authenticated user&#39;s session object via `$user-&gt;roles`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate higher-privileged roles — such as wholesale customer or administrator — and obtain discounted or otherwise restricted pricing that should not be available to their actual role. This vulnerability only has practical impact when the fixed user-role pricing feature is enabled and at least one product has a privileged-role price configured.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-9241 https://cve.radiocsirt.org/vuln/ghsa-44mh-4g8r-7822 <p>The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 1.4.6. This is due to the `get_value()` function in `classes/fixed/fixed_user_role.php` trusting the attacker-controlled `$_REQUEST[&#39;wooc_order_user_roles&#39;]` parameter to determine the user&#39;s role context for role-based price resolution without any validation, allowing it to override the legitimate role data derived from the authenticated user&#39;s session object via `$user-&gt;roles`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate higher-privileged roles — such as wholesale customer or administrator — and obtain discounted or otherwise restricted pricing that should not be available to their actual role. This vulnerability only has practical impact when the fixed user-role pricing feature is enabled and at least one product has a privileged-role price configured.</p> <p>The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 1.4.6. This is due to the `get_value()` function in `classes/fixed/fixed_user_role.php` trusting the attacker-controlled `$_REQUEST[&#39;wooc_order_user_roles&#39;]` parameter to determine the user&#39;s role context for role-based price resolution without any validation, allowing it to override the legitimate role data derived from the authenticated user&#39;s session object via `$user-&gt;roles`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate higher-privileged roles — such as wholesale customer or administrator — and obtain discounted or otherwise restricted pricing that should not be available to their actual role. This vulnerability only has practical impact when the fixed user-role pricing feature is enabled and at least one product has a privileged-role price configured.</p> https://cve.radiocsirt.org/vuln/ghsa-44mh-4g8r-7822