CVE-2025-54041
Lifecycle Timeline
2Tags
Description
Cross-Site Request Forgery (CSRF) vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Cross Site Request Forgery.This issue affects Wallet System for WooCommerce: from n/a through <= 2.6.7.
Analysis
Cross-site request forgery in WP Swings Wallet System for WooCommerce plugin through version 2.6.7 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users by crafting malicious web pages. The vulnerability affects all installations of the plugin up to and including version 2.6.7, with no public exploit code identified at time of analysis, though the low EPSS score (0.02%) suggests minimal real-world exploitation likelihood despite the straightforward attack mechanism.
Technical Context
The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery), a class of attack where an attacker tricks an authenticated user into performing unwanted actions on a target website without their knowledge or consent. The Wallet System for WooCommerce plugin, which extends WooCommerce functionality to manage cryptocurrency or digital wallet payments, lacks proper CSRF token validation on state-changing operations. This means the plugin fails to verify that requests modifying wallet balances, initiating transactions, or changing user settings originate from legitimate user interactions rather than attacker-controlled cross-origin requests. The plugin runs in the WordPress ecosystem (CPE context: WordPress plugin) where users are typically authenticated via browser cookies, making them vulnerable to CSRF exploitation if nonce verification is absent or improperly implemented.
Affected Products
Wallet System for WooCommerce plugin by WP Swings is vulnerable in all versions through 2.6.7. The plugin integrates with WooCommerce (WordPress e-commerce platform) and is distributed through the WordPress plugin repository. Affected installations include all active deployments using version 2.6.7 or earlier. The vulnerability does not affect specific WooCommerce or WordPress versions independently, only installations where the vulnerable plugin is active.
Remediation
Update the Wallet System for WooCommerce plugin to a version later than 2.6.7 immediately via the WordPress admin dashboard or directly from the plugin repository. WordPress site administrators should navigate to Plugins > Installed Plugins, locate Wallet System for WooCommerce, and click Update if available. If a patched version is not yet released in the official repository, disable the plugin temporarily until a security update is available. Review the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/wallet-system-for-woocommerce/vulnerability/wordpress-wallet-system-for-woocommerce-plugin-2-6-7-cross-site-request-forgery-csrf-vulnerability for the exact patched version and release timeline. No active workarounds are applicable for CSRF vulnerabilities in WordPress plugins; patching is the only reliable mitigation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today