Back to Database
Status published
Medium
CVE-2021-4376
WooCommerce Multi Currency <= 2.1.17 - Missing Authorization
Vulnerability Description
The WooCommerce Multi Currency plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.17. This makes it possible for authenticated attackers to change the price of a product to an arbitrary value.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-4376
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Jerome Bruandet
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d8a490c6-14c1-4c71-b44c-1e362cc892a8?source=cve
- https://wpscan.com/vulnerability/480125bc-bab3-45b8-9325-a4d406655a61
- https://wordpress.org/plugins/woo-multi-currency/#developers
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2734576%40woo-multi-currency&new=2734576%40woo-multi-currency&sfp_email=&sfph_mail=
More from villatheme
View All →CVE-2025-47570
WordPress WooCommerce Photo Reviews plugin <= 1.3.13 - Cross Site Scripting (XSS) vulnerability
High
7.1
CVE-2025-47563
WordPress CURCY plugin <= 2.3.7 - Arbitrary Shortcode Execution vulnerability
Medium
5.3
CVE-2025-14581
HAPPY – Helpdesk Support Ticket System <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Reply
Medium
4.3
CVE-2025-14541
Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter
High
7.2
CVE-2025-14509
Lucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags
High
7.2
Affected Vendor
villatheme
View all reports →Affected Software
CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x
Vulnerable Versions:
0
Timeline
Official Publish:
June 7th, 2023
Last Modified:
April 8th, 2026
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N