CVE-2019-18668

    Dashboard / Vulnerabilities / CVE-2019-18668

    CVE-2019-18668

    Published: 2 Nov 2019Last Modified: 10 Mar 2026

    Summary:

    Details: An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In this case, even though the currency does not exist, it will be selected, but a price amount will fall back to the default currency. This means that if an attacker provides a currency that does not exist and is worth less than this default, the attacker can eventually purchase an item for a significantly cheaper price.

    References: , https://wordpress.org/plugins/currency-switcher-woocommerce/#developers, https://wpvulndb.com/vulnerabilities/9936, https://www.infigo.hr/en/critical-vulnerability-in-currency-switcher-for-woocommerce-n61

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2019-18668 | CVE-DB