Description

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.

Related CPE's

Could not find any relations

References

https://wpscan.com/vulnerability/fd44c88d-2ca4-4e3d-9e9f-570e239df4bd/

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0

Secondary
CWE-639

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.5 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-08T06:16:46.533Z

26 hours ago

Last modified

2026-10-08T20:51:18.123Z

12 hours ago