CVE-2019-18668
MEDIUMEPSS 76th pctlDescription
An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In this case, even though the currency does not exist, it will be selected, but a price amount will fall back to the default currency. This means that if an attacker provides a currency that does not exist and is worth less than this default, the attacker can eventually purchase an item for a significantly cheaper price.
How to fix
Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.
CVSS v3 Vector
Exploitability
Impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Exploit Intelligence
Elevated risk: more likely to be exploited than 76% of all known CVEs.
References
Embed a live status badge for CVE-2019-18668
Markdown
[](https://tridentstack.com/cve/CVE-2019-18668)HTML
<a href="https://tridentstack.com/cve/CVE-2019-18668"><img src="https://tridentstack.com/cve/badge/CVE-2019-18668.svg" alt="CVE-2019-18668"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
Start freeThis product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.