The CURCY – Multi Currency for WooCommerce plugin for WordPress contains a missing authorization flaw resulting from a missing capability check on a function. This allows unauthenticated attackers to exploit incorrectly configured access control security levels to perform unauthorized actions.