CVE-2026-57332
HighCVSS 7.1Summary
The Wallet System for WooCommerce plugin version 2.7.6 and earlier contains a broken access control vulnerability for subscribers. This allows users with the subscriber role to perform operations they should not be authorized for.
Risk Assessment
The risk involves potential unauthorized access to wallet functions by subscribers, which could lead to data integrity breaches and unauthorized transactions.
Recommendation
It is recommended to immediately update the Wallet System for WooCommerce plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Wallet System for WooCommerce
See all- CVE-2026-15045Medium
The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.
- CVE-2026-42654High
Authentication bypass using an alternate path or channel vulnerability in WP Swings Wallet System for WooCommerce. Allows password recovery exploitation. This issue affects versions up to and including 2.7.5.
Original NVD description (English source)
Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions.