HDWebmobile Currency Switcher

HDWebmobile Currency Switcher

Let customers browse your store in their own currency — the admin-configured currency list and exchange rates can only ever be changed through a capability- and nonce-checked settings form.

Overview

HDWebmobile Currency Switcher adds a simple currency dropdown to your store. Customers pick a currency, prices convert everywhere (shop, product page, cart, checkout) using the rate you set, and their order is recorded in that currency.

A competing WooCommerce currency-switcher plugin had a serious authorization vulnerability (CVE-2026-4094, CVSS 8.1, CWE-862 Missing Authorization): its entire multi-currency configuration could be wiped out by any authenticated user — Contributor level and above — simply by visiting any wp-admin page with a woocs_reset parameter appended to the URL. The vulnerable code read that parameter directly from an admin_head hook with no capability check and no nonce at all. This plugin closes that vulnerability class by construction: the currency list and exchange rates are written in exactly one place, and that one place requires current_user_can('manage_woocommerce') AND a verified nonce before a single field is read — there is no admin_head/admin_init code path that acts on a bare URL parameter. The customer-facing currency switch is a completely separate, harmless mechanism: it only ever selects which already-admin-configured currency to display prices in, stored in the visitor’s own cookie, and an unlisted or tampered currency code is always silently ignored. Every submitted rate and currency code is independently validated regardless of who is calling.

Key Features

• Add as many currencies as you like, each with its own symbol, exchange rate, and decimal places
• A simple [hdcs_switcher] shortcode, plus automatic placement on shop and product pages
• Optionally show the switcher right in your site navigation menu (works with both classic and block themes)
• Optionally pick a visitor’s starting currency from their country, using WooCommerce’s own local geolocation — no third-party API is called, and a visitor who picks a currency always keeps their choice
• Prices convert consistently across shop, cart, and checkout using WooCommerce’s own price pipeline
• Orders are stamped with the currency the customer actually saw and paid in

Limitations

Please read before installing:

• Exchange rates are set manually by the store admin — there is no automatic exchange-rate lookup or daily update
• This does not manage multi-currency payment gateway settlement; whether your payment processor can actually settle in a given currency is between you and your gateway
• Automatic currency-by-country relies on WooCommerce’s own geolocation database being set up (a free MaxMind license key under WooCommerce > Settings > Integration)
• Automatic selection only chooses the starting currency on a visitor’s first look; it never overrides a currency the visitor has picked

Quick Setup

1. Upload the plugin files to the /wp-content/plugins/hdwebmobile-currency-switcher directory, or install through the Plugins screen directly.
2. Activate the plugin through the ‘Plugins’ screen in WordPress. WooCommerce must already be installed and active.
3. Go to WooCommerce > Settings > Currency Switcher, add your currencies and rates, and choose where the switcher appears.

Latest Version

Current stable version in readme: 1.1.0 (Adds optional nav-menu placement and WooCommerce-geolocation starting-currency selection, on top of the core manual multi-currency switcher.)

See our other WordPress plugins for more WooCommerce and site-utility tools.