Wallet for WooCommerce CVE-2026-16538

Requires the Wallet for WooCommerce plugin (before 1.6.10) installed and the wallet top-up feature enabled on a WooCommerce store that accepts customer accounts. The attacker needs a customer account and the ability to initiate a top-up and influence the payment amount actually captured versus the amount requested - the core condition is the plugin's failure to reconcile collected amount against credited amount. Limiting factors: exploitation is scoped to registered 'customers' (so stores without open registration or with manual account approval raise the bar despite the CVSS PR:N marking), and the top-up/wallet feature must be active; impact is confined to financial credit within the store rather than server compromise.

The published CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N), but that vector overstates real-world severity in two ways worth flagging: it marks PR:N (unauthenticated) while the description explicitly scopes the actor to 'customers,' implying a registered account is required, and it rates C:H even though the flaw's true impact is integrity/financial fraud, not confidentiality disclosure - verify the authentication assumption against the vendor advisory. Adjusting for those, this is best read as an authenticated, low-privilege integrity abuse with direct financial consequence rather than a full-blown critical RCE. That said, exploitation is trivial (AC:L), a public PoC exists, and the payoff is money, so any store with the plugin and open customer registration should patch immediately - even a mid-sized merchant with a small IT team should treat this as urgent, because the loss is realized on every abused top-up. EPSS of 13% is elevated for a plugin bug and consistent with a low-skill, high-motivation exploit; the absence of KEV listing suggests opportunistic fraud rather than confirmed mass exploitation so far.

An attacker registers as an ordinary store customer and initiates a wallet top-up, then manipulates the payment flow so the gateway captures a smaller amount (or a partial/failed capture) than the top-up value while the plugin still credits the full requested balance. The attacker repeatedly buys store credit below face value and spends it on goods, netting a direct financial gain; public PoC guidance from WPScan lowers the skill barrier.