CVE-2026-9241

Name of the Vulnerable Software and Affected Versions FOX – Currency Switcher Professional for WooCommerce versions prior to 1.4.7

Description An authorization bypass exists when the fixed user-role pricing feature is enabled and at least one product has a privileged-role price configured. The get value() function in classes/fixed/fixed user role.php trusts the $ REQUEST['wooc order user roles'] parameter without validation to determine the user's role context for price resolution. This allows the parameter to override the legitimate role data from the $user->roles session object. Consequently, authenticated users with Subscriber-level access or higher can impersonate privileged roles, such as administrators or wholesale customers, to obtain restricted or discounted pricing.

Recommendations Update to a version newer than 1.4.6. As a temporary mitigation, disable the fixed user-role pricing feature.