CVE-2026-39497

CVEs › CVE-2026-39497

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Blind SQL Injection.This issue affects FOX: from n/a through <= 1.4.5.

Overview

State: PUBLISHED
Assigner (CNA): Patchstack
CVSS severity: HIGH
CVSS score: 7.6 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Effective score: 7.6 / 10 HIGH source: CNA overview
CWE(s): CWE-89
Reserved: 2026-04-07
Published: 2026-04-08 10:30 UTC
Last updated: 2026-04-29 11:52 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39497.json
Linked Threat: CVE-2026-39497 — FOX <= 1.4.5 - Authenticated (Shop manager+) SQL Injection

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-04-08 09:16:24 UTC
NVD last modified: 2026-04-24 18:08:35 UTC
NVD CVSS v3.1: 7.6 / 10 HIGH source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Exploitability subscore: 2.3 / 10
Impact subscore: 4.7 / 10
EPSS score: 0.0004 (probability of exploitation in next 30 days)
EPSS percentile: 11.87% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

NVD / KEV / EPSS data refreshed 2026-05-25 12:00 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-20164
Assigner: Patchstack
Published: Apr 8, 2026, 8:30:12 AM
Updated: Apr 29, 2026, 9:52:01 AM
EUVD base score (CVSS 3.1): 7.6 / 10
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
EUVD-reported EPSS: 0.0400
Vendors: realmag777
Products: FOX (0 ≤1.4.5)
Aliases: GHSA-jx9c-j2q7-694g

ENISA description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Blind SQL Injection.This issue affects FOX: from n/a through <= 1.4.5.

EUVD references (1)

https://patchstack.com/database/Wordpress/Plugin/woocommerce-currency-switcher/vulnerability/wordpress-fox-plugin-1-4-5-sql-injection-vulnerability?_s_id=cve

Affected products (1)

Vendor	Product	Versions	Platforms
RealMag777	FOX	`0` (affected)	—

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

https://patchstack.com/database/Wordpress/Plugin/woocommerce-currency-switcher/vulnerability/wordpress-fox-plugin-1-4-5-sql-injection-vulnerability?_s_id=cve vdb-entry

MITRE references (1) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://patchstack.com/database/Wordpress/Plugin/woocommerce-currency-switcher/vulnerability/wordpress-fox-plugin-1-4-5-sql-injection-vulnerability?_s_id=cve vdb-entry

Web references (5)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

http://cwe.mitre.org/data/definitions/89.html rapid7:cwe.mitre.org
https://attackerkb.com/topics/CVE-2026-39497 rapid7:attackerkb.com
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-20164 rapid7:euvd.enisa.europa.eu
https://www.cve.org/CVERecord?id=CVE-2026-39497 rapid7:www.cve.org
https://www.wordfence.com/threat-intel/vulnerabilities/id/aa5b6311-d9ca-4736-a6e3-56c6746b2470?source=api-prod rapid7:www.wordfence.com

NVD-tagged references (1)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://patchstack.com/database/Wordpress/Plugin/woocommerce-currency-switcher/vulnerability/wordpress-fox-plugin-1-4-5-sql-injection-vulnerability?_s_id=cve audit@patchstack.com

Indicators (2)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
domain	`injection.this`	no local data	2026-05-18 21:18 UTC
cve	`CVE-2026-39497`	no local data	2026-06-05 13:26 UTC

Remediations (19)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Wordfence remediation: FOX – Currency Switcher Professional for WooCommerce

Wordfence

Update to version 1.4.6, or a newer patched version

2026-06-05 13:26 UTC
Microsoft Patch Tuesday April 2026 - 168 Vulnerabilities Fixed ...

web:cybersecuritynews.com

Microsoft has released its April 2026 Patch Tuesday security update, addressing 168 vulnerabilities across its product portfolio including one actively exploited zero-day and one publicly disclosed flaw that organizations must prioritize immediately.

2026-05-22 17:01 UTC
NVD - Home

web:nvd.nist.gov

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...

2026-05-22 17:01 UTC
Google Translate

web:translate.google.com

Google's service, offered free of charge, instantly translates words, phrases, and web pages between English and over 100 other languages.

2026-05-22 17:01 UTC
April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

2026-05-22 17:01 UTC
Microsoft Confirms Active 0-Day Exploit—Check Emergency Mitigation

web:www.forbes.com

Updated May 18: This article has been updated to include further details on the emergency mitigation process recommended by Microsoft after the CVE - 2026 -42897 Exchange Server zero-day was ...

2026-05-22 17:01 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-05-22 17:01 UTC
Windows 11 April 2026 Update tested: What's new, improved and fixed

web:www.windowslatest.com

Windows 11 April 2026 update adds Narrator Copilot support, faster Settings, File Explorer fixes, and key security improvements.

2026-05-22 17:01 UTC
Patch Tuesday May 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-05-22 17:01 UTC
FIX Stock Quote Price and Forecast | CNN

web:www.cnn.com

View Comfort Systems USA, Inc. FIX stock quote prices, financial information, real-time forecasts, and company news from CNN.

2026-05-22 03:40 UTC
Pennsylvania Access To Criminal History - Home - pa

web:epatch.pa.gov

Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...

2026-05-22 03:40 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-05-22 03:40 UTC
CVE‑2026‑43997: Remote Code Execution in vm2 Node.js Sandbox - What It ...

web:integsec.com

CVE‑2026‑43997 was disclosed on May 13, 2026 , through the National Vulnerability Database and is tracked against the open‑source vm2 library, a virtual‑machine sandbox used to run untrusted JavaScript inside Node.js applications. The vulnerability allows attackers to obtain the host object and escape the sandbox, enabling remote code execution on the server hosting the Node.js process.

2026-05-22 03:40 UTC
Concord NH Patch - Facebook

web:www.facebook.com

Concord NH Patch . 44,188 likes · 3,578 talking about this. Hyperlocal news, alerts, discussions and events for Concord, NH

2026-05-22 03:40 UTC
NVD - Vulnerabilities

web:nvd.nist.gov

Mitigation of the vulnerabilities in this context typically involves coding changes, but could also include specification changes or even specification deprecations (e.g., removal of affected protocols or functionality in their entirety)."

2026-05-22 03:40 UTC
Huntington News, Breaking News in Huntington, NY - Patch

web:patch.com

Huntington Latest Headlines: Water Service Restored After Dix Hills Water District Malfunction: Town; Best Buy Employee Used Customer's Phone To Send Intimate Photos Without Permission, Police ...

2026-05-22 03:40 UTC
Addressing Exchange Server May 2026 vulnerability CVE-2026-42897

web:techcommunity.microsoft.com

More information on this service can be found in Exchange Emergency Mitigation Service (Exchange EM Service) | Microsoft Learn. Customers with EM Service enabled can verify that their servers have applied the mitigation for CVE - 2026 -42897 (the ID of mitigation is M2.1.x) by doing the following:

2026-05-22 03:40 UTC
Oracle Critical Patch Update Advisory - January 2026

web:www.oracle.com

Oracle Critical Patch Update Advisory - January 2026 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical ...

2026-05-22 03:40 UTC
Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days

web:www.bleepingcomputer.com

Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.

2026-05-22 03:40 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-39497.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.6,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-39497",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-10T18:06:11.914093Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-10T18:06:22.368Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "woocommerce-currency-switcher",
          "product": "FOX",
          "vendor": "RealMag777",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.4.6",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.4.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "timomangcut | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-04-08T10:28:58.949Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Blind SQL Injection.<p>This issue affects FOX: from n/a through <= 1.4.5.</p>"
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Blind SQL Injection.This issue affects FOX: from n/a through <= 1.4.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-7",
          "descriptions": [
            {
              "lang": "en",
              "value": "Blind SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-29T09:52:01.939Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/Wordpress/Plugin/woocommerce-currency-switcher/vulnerability/wordpress-fox-plugin-1-4-5-sql-injection-vulnerability?_s_id=cve"
        }
      ],
      "title": "WordPress FOX plugin <= 1.4.5 - SQL Injection vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-39497",
    "datePublished": "2026-04-08T08:30:12.597Z",
    "dateReserved": "2026-04-07T10:47:43.843Z",
    "dateUpdated": "2026-04-29T09:52:01.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}