# CoDesigner WooCommerce Builder for Elementor <= 4.41 - Unauthenticated Order Currency Manipulation via Currency Switcher

- **ID:** WPSEC-2026-1329
- **Plugin:** CoDesigner – All in One Elementor WooCommerce Builder (`woolementor`), https://wordpress.org/plugins/woolementor/
- **Affected versions:** all versions before 4.42
- **Fixed in:** 4.42 (Update to 4.42 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woolementor
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1329/

## Description

The CoDesigner plugin for WordPress is vulnerable to order currency manipulation via the Currency Switcher module in all versions up to, and including, 4.41. This is due to the visitor-selected currency code, read from the 'cd_currency_code' cookie or user meta and set through the cd-change-currency AJAX action, being returned through the woocommerce_currency filter without being checked against the store's configured currencies. This makes it possible for unauthenticated attackers to have their order recorded and charged in an arbitrary currency the store owner never configured, at the same numeric amount, for example paying in a much less valuable currency. Exploitation requires the Currency Switcher module to be enabled and a payment gateway that accepts the chosen currency.

## References

- https://wpsec.com/vuln/WPSEC-2026-1329/
- https://plugins.svn.wordpress.org/woolementor/tags/4.42/
- https://wordpress.org/plugins/woolementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1329/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.