realmag777 FOX Plugin up to 1.4.6 on WordPress fixed_user_role.php get_value wooc_order_user_roles authorization

Summaryinfo

A vulnerability classified as critical has been found in realmag777 FOX Plugin up to 1.4.6 on WordPress. This affects the function get_value of the file classes/fixed/fixed_user_role.php. Performing a manipulation of the argument wooc_order_user_roles results in authorization. This vulnerability is identified as CVE-2026-9241. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in realmag777 FOX Plugin up to 1.4.6 on WordPress. This affects the function get_value of the file classes/fixed/fixed_user_role.php. The manipulation of the argument wooc_order_user_roles with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and including 1.4.6. This is due to the `get_value()` function in `classes/fixed/fixed_user_role.php` trusting the attacker-controlled `$_REQUEST['wooc_order_user_roles']` parameter to determine the user's role context for role-based price resolution without any validation, allowing it to override the legitimate role data derived from the authenticated user's session object via `$user->roles`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate higher-privileged roles — such as wholesale customer or administrator — and obtain discounted or otherwise restricted pricing that should not be available to their actual role. This vulnerability only has practical impact when the fixed user-role pricing feature is enabled and at least one product has a privileged-role price configured.

The weakness was released by Long Lagon. The advisory is shared at wordfence.com. This vulnerability is uniquely identified as CVE-2026-9241 since 05/21/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.

By approaching the search of inurl:classes/fixed/fixed_user_role.php it is possible to find vulnerable targets with Google Hacking.

Upgrading eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• realmag777

Name

• FOX Plugin

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.4.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion