CVE-2021-24566
📋 TL;DR
The WooCommerce Currency Switcher FOX WordPress plugin before version 1.3.7 contains a Local File Inclusion (LFI) vulnerability via the 'woocs' shortcode. This allows attackers to read arbitrary files on the server, potentially exposing sensitive configuration files, credentials, or other data. WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- WooCommerce Currency Switcher FOX WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive server files like wp-config.php containing database credentials, potentially leading to full site compromise, data theft, or server takeover.
Likely Case
Attackers read configuration files to obtain database credentials, leading to database access and potential data exfiltration or manipulation.
If Mitigated
With proper file permissions and security controls, attackers might only be able to read non-sensitive files, limiting the impact.
🎯 Exploit Status
Exploitation requires the 'woocs' shortcode to be present on a page, but no authentication is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.7
Vendor Advisory: https://jetpack.com/2021/07/22/severe-vulnerability-patched-in-woocommerce-currency-switcher/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'WooCommerce Currency Switcher FOX'. 4. Click 'Update Now' if available, or manually update to version 1.3.7+. 5. Verify the plugin version after update.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the plugin until patched
wp plugin deactivate woo-currency-switcher-fox
Remove woocs shortcode usage
allRemove or replace any instances of the [woocs] shortcode in posts/pages
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block LFI attempts
- Restrict file system permissions and implement strict file access controls
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin > Plugins > Installed Plugins for 'WooCommerce Currency Switcher FOX' version. If version is below 1.3.7, it's vulnerable.Check Version:
wp plugin list --name='WooCommerce Currency Switcher FOX' --field=versionVerify Fix Applied:
Verify plugin version shows 1.3.7 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing 'woocs' parameter with file path traversal patterns (../)
- Unusual file access patterns in web server logs
Network Indicators:
- HTTP requests to pages with woocs shortcode containing file path parameters
SIEM Query:
web.url:*woocs* AND (web.uri:*../* OR web.uri:*..\*)🔗 References
- https://jetpack.com/2021/07/22/severe-vulnerability-patched-in-woocommerce-currency-switcher/
- https://wpscan.com/vulnerability/a0bc4b13-53fe-462d-8306-8915196d3a5a/
- https://jetpack.com/2021/07/22/severe-vulnerability-patched-in-woocommerce-currency-switcher/
- https://wpscan.com/vulnerability/a0bc4b13-53fe-462d-8306-8915196d3a5a/
