CVE-2026-42654
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Authentication bypass using an alternate path or channel vulnerability in WP Swings Wallet System for WooCommerce. Allows password recovery exploitation. This issue affects versions up to and including 2.7.5.
Risk Assessment
Risk of unauthorized access to user accounts and potential theft of funds.
Recommendation
Update the Wallet System for WooCommerce plugin to a version newer than 2.7.5.
Other vulnerabilities in Wallet System for WooCommerce
See all- CVE-2026-57332High
The Wallet System for WooCommerce plugin version 2.7.6 and earlier contains a broken access control vulnerability for subscribers. This allows users with the subscriber role to perform operations they should not be authorized for.
- CVE-2026-15045Medium
The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.
Original NVD description (English source)
Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Swings Wallet System for WooCommerce allows Password Recovery Exploitation. This issue affects Wallet System for WooCommerce: from n/a through 2.7.5.