CVE-2026-93509
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient. This allows an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.
Risk Assessment
An attacker can illegitimately generate funds or steal other users' balances, leading to financial loss and data integrity violations. Only a low-privilege account is required.
Recommendation
Update the Wallet System for WooCommerce plugin to version 2.8.0 or later. Review transaction history for suspicious transfers.
Other vulnerabilities in Wallet System for WooCommerce
See all- CVE-2026-57332High
The Wallet System for WooCommerce plugin version 2.7.6 and earlier contains a broken access control vulnerability for subscribers. This allows users with the subscriber role to perform operations they should not be authorized for.
- CVE-2026-94246Medium
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.
- CVE-2026-94245Medium
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.
- CVE-2026-94244Medium
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user, such as a subscriber, to disclose all users' names, email addresses, roles, transaction amounts, payment methods and dates.
- CVE-2026-15045Medium
The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.
- CVE-2026-42654High
Authentication bypass using an alternate path or channel vulnerability in WP Swings Wallet System for WooCommerce. Allows password recovery exploitation. This issue affects versions up to and including 2.7.5.
- CVE-2025-68029Medium
Wallet System for WooCommerce (wallet-system-for-woocommerce) has a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions through 2.7.3.
Original NVD description (English source)
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS