WordPress Plugin Vulnerabilities

CURCY – Multi Currency for WooCommerce < 2.2.18 - Missing Authorization

Description

The CURCY – Multi Currency for WooCommerce plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.2.17. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
woo-multi-currency
Fixed in 2.2.18

References

CVE
CVE-2026-97071
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e8d58619-1e44-4ec5-866c-be1d8d63ab28

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
dcs
Verified
No
WPVDB ID
fd10b9b2-6800-49e2-b7b5-f97e803bd0fa

Timeline

Publicly Published
2026-10-05 (about 12 days ago)
Added
2026-10-09 (about 7 days ago)
Last Updated
2026-10-09 (about 7 days ago)

Other

Published
Title
Published
2026-09-17
Title
WP < 7.1.1 - Admin+ Network-Wide Plugin Activation on Multisite
Published
2024-12-02
Title
Pie Register Premium < 3.8.3.3 - Unauthenticated Arbitrary File Upload
Published
2025-02-03
Title
Export Order, Product, Customer & Coupon for WooCommerce to Google Sheets < 1.9 - Missing Authorization
Published
2026-10-08
Title
Event Tickets and Registration < 5.30.0.2 - Missing Authorization
Published
2023-09-22
Title
Ad Inserter – Ad Manager & AdSense Ads < 2.7.31 - Unauthenticated Sensitive Information Exposure