EUVD-2026-57171
GHSA-gf9j-rpmq-8vq3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
PR:L reflects required customer account; I:H captures complete payment bypass; C:N and A:N confirmed as no data is exposed and service availability is unaffected.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.
AnalysisAI
Authenticated customers on WooCommerce stores running Wallet System for WooCommerce before 2.7.10 can complete purchases for free by submitting arbitrarily inflated wallet deduction amounts during checkout that the plugin accepts without verifying against the customer's actual stored balance. This business logic flaw enables systematic payment fraud - any registered shopper can zero out an order total and receive goods or services without paying the merchant. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a registered and authenticated customer account on the targeted store (PR:L per CVSS vector - any user who can self-register qualifies). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately reflects the real-world risk: network-exploitable with low complexity, but gated behind an authenticated customer account (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A registered customer logs into a WooCommerce store, adds high-value items to their cart, and uses an HTTP proxy to intercept and modify the checkout POST request, setting the wallet deduction parameter to the full order total regardless of their actual wallet balance. The plugin processes the tampered amount without querying the stored balance, marks the order as fully paid, and the merchant fulfills the order having collected no funds. … |
| Remediation | Update the Wallet System for WooCommerce plugin to version 2.7.10 or later immediately; this is the vendor-released patch confirmed by WPScan's advisory (https://wpscan.com/vulnerability/fc818fa4-5daa-430f-82da-0c96ec531ca3/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in the WP Swings Wallet System for WooCommerce plugin (versions up to and including 2.7.5) allows
Improper authorization in the Wallet System for WooCommerce WordPress plugin (versions 2.7.6 and earlier) lets low-privi
The Wallet System for WooCommerce - Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for Wor
The Wallet System for WooCommerce - Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for Wor
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today