CVE-2021-4379

MEDIO 6.5CVE-2021-4379 · Published 07/06/2023 · updated 17/06/2026

In breve

CVE-2021-4379 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda woocommerce multi currency (villatheme).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.80%, superiore al 56.5% delle vulnerabilità.
Correzione: aggiornare a 2.1.18 o successiva.

Package	Affected versions	Patched versions
woocommerce multi currency villatheme	`< 2.1.18`	`2.1.18`

Description

The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmc_bulk_fixed_price function in versions up to, and including, 2.1.17. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to make changes to product prices.

References

blog.nintechnet.com/vulnerability-fixed-in-wordpress-woocommerce-multi-currency-plugin · Exploit
codecanyon.net/item/woocommerce-multi-currency/20948446 · Product
wordfence.com/threat-intel/vulnerabilities/id/e2318ae9-4115-442e-9293-a9251787c5f3 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free