CVE-2019-18668

An issue was discovered in the Currency Switcher addon before 2.11.2 for WooCommerce if a user provides a currency that was not added by the administrator. In this case, even though the currency does not exist, it will be selected, but a price amount will fall back to the default currency. This means that if an attacker provides a currency that does not exist and is worth less than this default, the attacker can eventually purchase an item for a significantly cheaper price.

• CWE-755

• https://wordpress.org/plugins/currency-switcher-woocommerce/#developersRelease Notes, Vendor Advisory
• https://wpvulndb.com/vulnerabilities/9936Third Party Advisory
• https://www.infigo.hr/en/critical-vulnerability-in-currency-switcher-for-woocommerce-n61Third Party Advisory
• https://wordpress.org/plugins/currency-switcher-woocommerce/#developersRelease Notes, Vendor Advisory
• https://wpvulndb.com/vulnerabilities/9936Third Party Advisory
• https://www.infigo.hr/en/critical-vulnerability-in-currency-switcher-for-woocommerce-n61Third Party Advisory

Published

Nov 2, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18662An issue was discovered in YouPHPTube through 7.7. User inpu…9.8
• CVE-2019-18663A SQL injection vulnerability in a /login/forgot1 POST reque…9.8
• CVE-2019-18664The Log module in SECUDOS DOMOS before 5.6 allows XSS.5.4
• CVE-2019-18665The Log module in SECUDOS DOMOS before 5.6 allows local file…7.5
• CVE-2019-18666An issue was discovered on D-Link DAP-1360 revision F device…9.8
• CVE-2019-18667/usr/local/www/freeradius_view_config.php in the freeradius3…6.1
• CVE-2019-1867A vulnerability in the REST API of Cisco Elastic Services Co…10
• CVE-2019-18670In the Quick Access Service (QAAdminAgent.exe) in Acer Quick…7.8
• CVE-2019-18671Insufficient checks in the USB packet handling of the ShapeS…9.8
• CVE-2019-18672Insufficient checks in the finite state machine of the Shape…7.5
• CVE-2019-18673On SHIFT BitBox02 devices, a side channel for the row-based …4.6
• CVE-2019-18674An issue was discovered in Joomla! before 3.9.13. A missing …5.3