CVE-2023-2556

Name of the Vulnerable Software and Affected Versions WPCS – WordPress Currency Switcher Professional plugin versions up to, and including, 1.1.9

Description The issue allows authenticated attackers with subscriber-level permissions and above to delete an arbitrary custom drop-down currency switcher due to a missing capability check on the anonymous function for the wpcs sd delete action.

Recommendations For versions up to, and including, 1.1.9, update to a version that includes a fix for the missing capability check on the wpcs sd delete action to prevent unauthorized modification of data. As a temporary workaround, consider restricting access to the wpcs sd delete action to prevent exploitation.