CVE-2026-39501: 
WordPress vulnerability analysis and mitigation

CVE-2026-39501 is a Missing Authorization (Broken Access Control) vulnerability in the FOX – Currency Switcher Professional for WooCommerce WordPress plugin, developed by RealMag777. It affects all versions up to and including 1.4.5, and was reported by researcher Que Thanh Tuan on February 25, 2026, with public disclosure on March 27, 2026, and CVE assignment on April 8, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), assessed by CISA-ADP (Patchstack, NVD).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions related to currency settings or shop configurations. An unauthenticated remote attacker can exploit misconfigured access control security levels by sending crafted network requests to affected plugin endpoints without supplying valid credentials or nonce tokens. No special preconditions beyond network access to a vulnerable WordPress/WooCommerce installation are required (Patchstack, NVD).

Successful exploitation allows unauthenticated attackers to bypass access restrictions and access or potentially modify currency settings and sensitive WooCommerce shop configurations. The primary impact is a low-level confidentiality breach (unauthorized read access), with no direct integrity or availability impact as reflected in the CVSS score. While the individual impact is limited, mass-exploit campaigns targeting WordPress plugins of this type can affect thousands of sites simultaneously regardless of their traffic or popularity (Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

The vulnerability is patched in FOX – Currency Switcher Professional for WooCommerce version 1.4.6 and later. Site administrators should update the plugin to version 1.4.6 or higher immediately. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

The vulnerability was assigned a low priority by Patchstack, which assessed it as unlikely to be exploited due to its limited impact. Wordfence referenced the vulnerability in their weekly WordPress vulnerability report for the period of March 23–29, 2026. No significant broader media coverage or notable researcher commentary beyond standard disclosure channels has been identified (Wordfence, Patchstack).