Authenticated configuration deletion via unchecked reset request

Missing authorization in FOX – Currency Switcher Professional for WooCommerce 1.4.5 and earlier allows remote authenticated users to delete its configuration. The admin_head handler accepts woocs_reset from the request and deletes all multi-currency settings without a capability check or nonce verification. Contributor-level access reaches any wp-admin page directly; an administrator can instead be induced to submit the reset through CSRF, while Subscriber access works only when wp-admin is exposed to that role.