Wallet System for WooCommerce CVE-2026-42654

Exploitation requires that the target site has the WP Swings Wallet System for WooCommerce plugin installed and active at version 2.7.5 or earlier, and that the attacker holds a low-privileged authenticated session on the WordPress site (CVSS PR:L) - in practice a self-registered WooCommerce customer account, which is achievable on any store with customer registration enabled (the default for stores using a wallet plugin). The vulnerable behavior is specifically the plugin's password recovery flow being usable as an alternate authentication channel (CWE-288), so reaching that recovery endpoint over the network is the concrete trigger; no user interaction from the victim is required (UI:N). Limiting factors: stores that disable customer self-registration, restrict the WordPress login/recovery endpoints by IP, or have already removed/deactivated the plugin are not exposed; no special non-default plugin configuration is documented as required by the advisory.

The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) indicates a network-reachable, low-complexity attack that requires the attacker to already hold a low-privileged account (PR:L, typically a customer/subscriber on the WooCommerce store) and produces high integrity impact with no availability impact and only limited confidentiality exposure - consistent with hijacking another user's account/wallet via the recovery channel rather than dumping the full database. No EPSS score, KEV listing, SSVC decision, or public POC was supplied in the intelligence package, so exploitation likelihood beyond the CVSS profile is unknown; the only source is a Patchstack advisory reported by Patchstack itself. Realistic priority is moderate-to-high for any WooCommerce site that allows customer self-registration (which is the default for stores using this plugin), because PR:L is trivially satisfied; sites that disable customer registration materially reduce exposure.

An attacker registers an ordinary customer account on a vulnerable WooCommerce store (satisfying PR:L), then targets a higher-value victim account - for example, a customer with a large wallet balance or a shop administrator - by abusing the plugin's password recovery flow as an alternate authentication channel to reset or hijack the victim's credentials. Once in control, the attacker logs in as the victim, drains the stored wallet balance, redirects refunds, or pivots further into the store; no public POC is referenced in the supplied data.