CVE-2026-124409: WordPress CURCY plugin <= 2.2.21 - Broken Access Control vulnerability
Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.21.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.22
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that exploitation can be performed remotely over the network without authentication or user interaction. No privileges are required.
What is the likely impact of successful exploitation?
The recorded impact is limited to integrity, with no stated confidentiality or availability impact. The vulnerability is classified as medium severity with a CVSS score of 5.3.
Which CURCY versions are affected?
CURCY versions through 2.2.21 are affected. The available data does not identify a fixed version.