CVE-2021-4376 in WooCommerce Multi Currency Plugin
Summary
by MITRE • 06/07/2023
The WooCommerce Multi Currency plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.17. This makes it possible for authenticated attackers to change the price of a product to an arbitrary value.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/09/2026
The WooCommerce Multi Currency plugin vulnerability represents a critical authorization flaw that undermines the security of e-commerce transactions within WordPress environments. This weakness exists in versions up to and including 2.1.17 of the plugin, creating a pathway for malicious actors who have gained authenticated access to manipulate product pricing data. The vulnerability stems from insufficient validation of user permissions during currency conversion operations, allowing unauthorized modifications to product pricing structures.
From a technical perspective, this missing authorization issue manifests as a failure to properly verify that the requesting user possesses adequate privileges to modify pricing information. The flaw operates at the application level where currency conversion functions do not adequately check user roles or capabilities before executing price modification operations. This allows authenticated users with limited permissions to submit requests that bypass normal access controls, potentially enabling arbitrary price changes that could result in financial loss or market manipulation.
The operational impact of this vulnerability extends beyond simple price manipulation to encompass broader security implications for online commerce platforms. Attackers could exploit this weakness to create artificial discounts, inflate prices, or implement other pricing strategies that compromise the integrity of the e-commerce ecosystem. The vulnerability particularly affects businesses relying on WooCommerce for their online sales, as it undermines consumer trust and creates opportunities for financial fraud. Organizations may experience direct monetary losses, reputational damage, and potential regulatory compliance issues depending on their jurisdiction and industry requirements.
Security professionals should recognize this vulnerability as a variant of CWE-863, which addresses "Incorrect Authorization" conditions in software systems. The flaw aligns with ATT&CK technique T1078.004, which covers legitimate credentials compromise through credential access methods. Organizations should implement immediate mitigations including plugin updates to versions that address the authorization gap, along with enhanced monitoring of pricing modification activities. Additional defensive measures include implementing role-based access controls, regular security audits of e-commerce plugins, and establishing automated alerts for suspicious pricing changes. The vulnerability underscores the critical importance of maintaining current security patches and conducting thorough security assessments of third-party plugins in WordPress environments, particularly those handling financial transactions and currency conversions.