CVE-2019-18668 Business logic in n/a
Attackers can purchase items at significantly reduced prices by specifying non-existent currencies, bypassing intended pricing logic in the Currency Switcher addon.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-18668?
CVE-2019-18668 is a medium-severity vulnerability in n/a, published on 2 Nov 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In this case, even though the currency does not exist, it will be selected, but a price amount will fall back to the default currency. This means that if an attacker provides a currency that does not exist and is worth less than this default, the attacker can eventually purchase an item for a significantly cheaper price.
Weakness: CWE-755
Which versions are affected by CVE-2019-18668?
It affects 1 product.
Products include Wpwham Currency Switcher for Woocommerce.
How do I fix CVE-2019-18668?
No fix has been published for CVE-2019-18668 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-18668 being exploited?
There is no known exploitation of CVE-2019-18668 in the wild and no public exploit code.
Sources
Also known as GHSA-cxrr-phf8-4pfv.