What is the CVSS score of CVE-2026-57332?

CVE-2026-57332 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Wallet System For Woocommerce are affected by CVE-2026-57332?

The Wallet System for WooCommerce plugin (versions 2.7.6 and earlier) allows subscriber-level users to bypass authorization controls and modify wallet balances, creating direct financial risk on…

How to fix or mitigate CVE-2026-57332?

Within 24 hours: Identify all WooCommerce instances running Wallet System 2.7.6 or earlier; audit and restrict subscriber-level account provisioning. Within 7 days: Implement compensating controls including wallet transaction monitoring and role-based access restrictions; evaluate plugin criticality for potential disable decision. Within 30 days: Monitor vendor security advisories for patched versions and deploy immediately upon release.

Wallet System For Woocommerce CVE-2026-57332

EUVD-2026-40103 HIGH

Missing Authorization (CWE-862)

2026-06-29 Patchstack

GHSA-h2vf-g593-6wfx

WordPress Authentication Bypass Wallet System For Woocommerce Wordpress Plugin Wp Swings

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:17 vuln.today

CVE Published

Jun 29, 2026 - 13:36 cve.org

HIGH 7.1

DescriptionCVE.org

Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions.

AnalysisAI

Improper authorization in the Wallet System for WooCommerce WordPress plugin (versions 2.7.6 and earlier) lets low-privileged authenticated users — subscriber-level accounts — perform wallet actions reserved for higher roles, enabling manipulation of stored wallet balances and transactions. The flaw, reported by Patchstack and tracked as CWE-862 (Missing Authorization), carries a 7.1 (High) CVSS score driven by high integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.