CVE-2026-108174— WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability
Quick assessment
Affected
PluginUs.Net FOX
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
插件 Us.Net FOX woocommerce-currency-switcher 存在缺失授权漏洞，该漏洞允许利用配置不当的访问控制安全级别。此问题影响 FOX 插件，适用于从 n/a 到 1.5.4 版本。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| PluginUs.Net | FOX | ≤ 1.5.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108174
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PluginUs.Net | FOX | 0 ~ 1.5.4 | - |
|
II. Public POCs for CVE-2026-108174
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108174
请登录查看更多情报信息。
Other References for CVE-2026-108174 (1)
Same Patch Batch · PluginUs.Net · 2026-10-13 · 3 CVEs total
| CVE-2026-108179 | 7.6 HIGH | WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability |
| CVE-2026-108489 | 5.3 MEDIUM | WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive Data Exposure |
IV. Related Vulnerabilities
Same product: FOX
-
CVE-2026-57319
WordPress FOX plugin <= 1.4.8 - Cross Site Scripting (XSS) v -
CVE-2026-39497
WordPress FOX plugin <= 1.4.5 - SQL Injection vulnerability -
CVE-2026-39501
WordPress FOX plugin <= 1.4.5 - Broken Access Control vulner -
CVE-2021-24566
WooCommerce Currency Switcher < 1.3.7 - Authenticated (Low P
Same vendor: PluginUs.Net
-
CVE-2026-108175
WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) -
CVE-2026-108151
WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vu -
CVE-2026-108179
WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability -
CVE-2026-108489
WordPress Active Products Tables for WooCommerce plugin <= 2 -
CVE-2026-95608
WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XS
Same weakness: CWE-862
-
CVE-2026-92629
联想百应PC客户端越权执行任意代码漏洞 -
CVE-2026-111353
Peppermint through 0.5.5 Missing Authorization via Time-Trac -
CVE-2026-111350
Papermark through 0.22.0 Missing Authorization in Data Room -
CVE-2026-111349
Craftplan through 0.7.5 Missing Authorization via CRM Custom -
CVE-2026-111343
pig through 4.1.1 Missing Authorization via GET /admin/user/
V. Comments for CVE-2026-108174
No comments yet