The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress suffers from a code injection vulnerability (CWE-94) identified as CVE-2024-8271. The issue arises because the plugin does not properly validate input before executing the do_shortcode function within 'woocs_get_custom_price_html'. This flaw enables unauthenticated attackers to execute arbitrary shortcodes, potentially leading to unauthorized code execution. The vulnerability affects all versions up to and including 1.4.2.1. The CVSS 3.1 base score is 7.3, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary shortcodes within the WordPress environment, which may lead to unauthorized code execution affecting confidentiality, integrity, and availability of the affected system. This could compromise the website running the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official channels from realmag777 or WordPress plugin repositories for updates.