CoDesigner WooCommerce Builder for Elementor <= 4.41 - Unauthenticated Order Currency Manipulation via Currency Switcher
- ID
- WPSEC-2026-1329
- Plugin
- CoDesigner – All in One Elementor WooCommerce Builder (woolementor)
- Affected
- all versions before 4.42
- Remediation
- Update to 4.42 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- CoDesigner WooCommerce Builder for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The CoDesigner plugin for WordPress is vulnerable to order currency manipulation via the Currency Switcher module in all versions up to, and including, 4.41. This is due to the visitor-selected currency code, read from the 'cd_currency_code' cookie or user meta and set through the cd-change-currency AJAX action, being returned through the woocommerce_currency filter without being checked against the store's configured currencies. This makes it possible for unauthenticated attackers to have their order recorded and charged in an arbitrary currency the store owner never configured, at the same numeric amount, for example paying in a much less valuable currency. Exploitation requires the Currency Switcher module to be enabled and a payment gateway that accepts the chosen currency.
References
- https://wpsec.com/vuln/WPSEC-2026-1329/
- https://plugins.svn.wordpress.org/woolementor/tags/4.42/
- https://wordpress.org/plugins/woolementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS