CVE-2024-8271 is a high severity (CVSS 7.3) arbitrary shortcode execution in the FOX Currency Switcher Professional plugin for WooCommerce, through version 1.4.2.1. It needs no login. The plugin changelog lists 1.4.2.2 as a security fix release.
What's affected
The record covers all versions up to and including 1.4.2.1. The cause is the function woocs_get_custom_price_html, which calls do_shortcode without properly validating the value it receives. An unauthenticated visitor can therefore cause shortcodes to run.
The plugin's changelog lists version 1.4.2.2 as "1 security issue fixed", credited to a Wordfence researcher, directly after 1.4.2.1. That timing matches the record, but the entry does not name the CVE, so check the Wordfence entry in the record's references before calling it confirmed. The plugin has shipped many releases since, so move to the latest one.
The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, scoring 7.3. The class is CWE-94, improper control of code generation. It is not marked as known exploited by CISA.
How to check if you're exposed
With WP-CLI:
wp plugin get woocommerce-currency-switcher --field=version
Anything at 1.4.2.1 or below needs an update. Also check which other plugins register shortcodes on the site. The practical danger of arbitrary shortcode execution depends on what shortcodes exist. A site with only core shortcodes has less to lose than one with form builders, membership plugins or code snippet tools installed.
Confirm that the free WOOCS plugin and the professional edition are both accounted for, since they are separate packages with separate update channels.
What to do now
- Update FOX Currency Switcher Professional to the latest release from your licensed source.
- List all active plugins that register shortcodes, and remove those you do not use.
- Review any plugin that can run PHP or stored code from a shortcode, since that raises the impact of this class of bug.
- Check web server logs for odd requests to the plugin's AJAX actions from before the update.
- Keep automatic updates on for plugins that handle storefront traffic.
Why it matters
The record is blunt about the condition: the software lets a user trigger an action that runs do_shortcode on an unchecked value. WordPress shortcodes are small pieces of server side behavior. If an attacker chooses the shortcode, they choose the behavior, limited only by what is installed.
Storefront plugins sit on the public side of your site, so an unauthenticated bug there is reachable by anyone. The impact scores are only low across the board in the vector, yet that rating assumes a typical shortcode set. Your own list of installed plugins decides the real outcome. A dependency inventory that includes plugins, not only application libraries, makes that assessment a lookup rather than a guess.
Quick check
Is a login required?
No. The record rates privileges required as none, so any visitor can reach the vulnerable action.
Why is the score only 7.3?
The vector rates confidentiality, integrity and availability impact as low each, assuming limited shortcode capability. Plugins that expose powerful shortcodes can raise the practical risk.
Sources
Last reviewed: 19 October 2026.
