What’s Vulnerable › Vulnerabilities

CVE-2019-18668

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-02 · updated 2026-06-17
• Weakness: CWE-755

Description

An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In this case, even though the currency does not exist, it will be selected, but a price amount will fall back to the default currency. This means that if an attacker provides a currency that does not exist and is worth less than this default, the attacker can eventually purchase an item for a significantly cheaper price.

Affected products

• wpwham Currency Switcher for WooCommerce: before 2.11.2 — fixed in 2.11.2

How to fix

Upgrade to a fixed version: wpwham Currency Switcher for WooCommerce 2.11.2. Check the vendor advisory for mitigations.

References

• https://wordpress.org/plugins/currency-switcher-woocommerce/#developers
• https://wpvulndb.com/vulnerabilities/9936
• https://www.infigo.hr/en/critical-vulnerability-in-currency-switcher-for-woocommerce-n61
• https://wordpress.org/plugins/currency-switcher-woocommerce/#developers
• https://wpvulndb.com/vulnerabilities/9936
• https://www.infigo.hr/en/critical-vulnerability-in-currency-switcher-for-woocommerce-n61

Get alerted when CVE-2019-18668 or the next vulnerability affects your stack