The FOX – Currency Switcher Professional for WooCommerce plugin contains an authorization bypass vulnerability (CWE-639) due to improper validation of the $_REQUEST['wooc_order_user_roles'] parameter in the get_value() function within classes/fixed/fixed_user_role.php. This parameter is attacker-controlled and overrides the legitimate user role data derived from the authenticated user's session, allowing users with Subscriber-level access or above to impersonate higher-privileged roles. This can lead to unauthorized access to discounted or restricted pricing configured for privileged roles. The vulnerability affects all versions up to and including 1.4.6 and requires the fixed user-role pricing feature to be enabled with at least one product configured with privileged-role pricing.

Authenticated users with Subscriber-level access or higher can bypass role-based authorization controls to impersonate higher-privileged roles. This enables them to obtain pricing benefits intended only for privileged roles such as wholesale customers or administrators. There is no impact on confidentiality or availability, and the vulnerability does not allow privilege escalation beyond pricing manipulation. The practical impact depends on the fixed user-role pricing feature being enabled and privileged-role prices being configured.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the fixed user-role pricing feature or avoid configuring privileged-role pricing to mitigate the risk. Monitor for updates from the vendor realmag777 regarding patches or official workarounds.