What is the CVSS score of CVE-2026-42654?

CVE-2026-42654 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wallet System for WooCommerce are affected by CVE-2026-42654?

WooCommerce retailers using the WP Swings Wallet System plugin (up to v2.7.5) face significant risk of customer account takeover and wallet theft due to an authentication bypass in the password…

How to fix or mitigate CVE-2026-42654?

Within 24 hours: Audit all WooCommerce instances for WP Swings Wallet System plugin installation and identify affected versions (2.7.5 and earlier). Within 7 days: Implement rate limiting on password recovery requests (e.g., 3 attempts per 15 minutes per IP), enable comprehensive audit logging of password reset activity, restrict password recovery access to specific user roles, and establish monitoring alerts for unusual reset patterns. Within 30 days: Either upgrade to a patched version upon vendor release or uninstall the plugin and migrate to an alternative WooCommerce wallet solution with equivalent functionality.

Wallet System for WooCommerce CVE-2026-42654

EUVD-2026-33947 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-06-02 Patchstack

GHSA-qqrj-x4c5-376m

WordPress Authentication Bypass

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 16:00 vuln.today

CVE Published

Jun 02, 2026 - 14:48 nvd

HIGH 7.1

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Swings Wallet System for WooCommerce allows Password Recovery Exploitation.

This issue affects Wallet System for WooCommerce: from n/a through 2.7.5.

AnalysisAI

Authentication bypass in the WP Swings Wallet System for WooCommerce plugin (versions up to and including 2.7.5) allows an authenticated low-privileged attacker to abuse the password recovery flow as an alternate channel to take over other accounts. Successful exploitation yields high impact to integrity (account/wallet compromise) with limited confidentiality exposure, and no public exploit has been identified at time of analysis.

Technical ContextAI

The affected component is the Wallet System for WooCommerce WordPress plugin developed by WP Swings (CPE cpe:2.3:a:wp_swings:wallet_system_for_woocommerce), which adds digital wallet, credit, and refund-handling capabilities to WooCommerce storefronts. The root cause is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel), meaning a code path - here, the password recovery/reset flow - performs authentication-equivalent actions without enforcing the same identity checks as the primary login path. Because wallets store monetary balances tied to user accounts, weaknesses in the surrounding WordPress/WooCommerce account-recovery integration translate directly into financial risk for the merchant and customers.

RemediationAI

No vendor-released patched version is identified in the supplied data; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wallet-system-for-woocommerce/vulnerability/wordpress-wallet-system-for-woocommerce-plugin-2-7-5-broken-authentication-vulnerability should be monitored for an upgrade beyond 2.7.5, and once published, administrators should upgrade Wallet System for WooCommerce to the first version above 2.7.5 via the WordPress plugin updater. Until a fix ships, compensating controls include temporarily deactivating the plugin (trade-off: wallet balances, refunds-to-wallet, and store credit functionality become unavailable to customers), disabling open customer registration in WooCommerce settings to remove the PR:L precondition (trade-off: blocks new-customer self-signup and may impact conversion), placing a WAF or Patchstack vPatch rule in front of the wallet/password-recovery endpoints exposed by the plugin, and forcing a site-wide password reset plus auditing wallet transaction logs for unexpected balance transfers or account takeovers once a patch is applied.