WooCommerce Currency Switcher Missing Capability Checks

The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'admin_head' function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete the entire multi-currency configuration by visiting any wp-admin page with the `woocs_reset` parameter appended. Additionally, because no nonce is verified, this is also exploitable via Cross-Site Request Forgery against any administrator. The vulnerability may also be exploited by Subscriber-level users if the site is configured to allow Subscriber access to 'wp-admin' pages.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The FOX – Currency Switcher Professional for WooCommerce plugin contains a critical authorization flaw in versions up to 1.4.5 that allows authenticated attackers with Contributor-level access to delete an entire multi-currency configuration. By simply visiting any wp-admin page with the `woocs_reset` parameter, attackers can trigger destructive actions without proper permission validation or CSRF protection. This vulnerability affects any WordPress site using this plugin, creating a significant data loss risk where threat actors with minimal privileges can cause operational disruption by wiping business-critical currency settings that directly impact e-commerce functionality.

Casky's 261 mapped skills detect the attack patterns behind this vulnerability by analyzing both privilege escalation (TA0004) and credential access (TA0006) techniques through Claude's extended reasoning. Practitioners using Casky would identify findings showing unauthorized administrative function calls from low-privilege accounts, missing nonce validation in sensitive parameters, and detection of wp-admin page requests containing parameter-based command injection patterns. The platform would flag the absence of capability checks (CWE-862) on functions hooked to early WordPress actions like 'admin_head'—revealing how attackers bypass intended permission boundaries. Security teams would see cross-request forgery indicators where state-changing operations lack CSRF tokens, combined with unusual permission grants to Contributor-level roles accessing administrative functions, enabling rapid incident response and vulnerability remediation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-4094.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-4094

Casky has 261 skills that investigate the attack patterns behind CVE-2026-4094. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn