Skip to main content

Wallet System for WooCommerce CVE-2026-94245

| EUVDEUVD-2026-94751 MEDIUM
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-10-08 contact@wpscan.com GHSA-m3qw-4467-jrhh
WordPress Authentication Bypass Woocommerce
6.5
CVSS 3.1 · Vendor: wpscan
Share

Severity by source

Vendor (wpscan) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
vuln.today AI
6.5 MEDIUM

A remotely reachable transfer endpoint abusable by any authenticated low-privilege user (PR:L, AC:L, UI:N); impact is unauthorized modification of wallet balances (I:H) with no disclosure or outage (C:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wpscan).

CVSS VectorVendor: wpscan

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

6
Metadata Corrected
Oct 08, 2026 - 11:40 vuln.today
tag: Woocommerce added
Analysis Generated
Oct 08, 2026 - 11:30 vuln.today
CVSS changed
Oct 08, 2026 - 11:22 NVD
6.5 (MEDIUM)
Patch available
Oct 08, 2026 - 07:01 EUVD
CVE Published
Oct 08, 2026 - 06:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Oct 08, 2026 - 06:16 cve.org
MEDIUM 6.5

DescriptionCVE.org

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.

AnalysisAI

Authenticated wallet-balance theft affects WooCommerce stores running the Wallet System for WooCommerce plugin in versions 2.0.0 through 2.7.x, where the wallet-transfer routine fails to confirm that the submitting user owns the wallet being debited. Because only a valid login is required (CVSS PR:L), any self-registered Subscriber can nominate an arbitrary user's wallet as the transfer source - including an administrator's - and drain its balance into an account they control, producing a high integrity impact with no confidentiality or availability loss (CVSS 6.5). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the 'Wallet System for WooCommerce' plugin (versions 2.0.0 up to but not including 2.8.0) installed and active on a WooCommerce store, and the attacker must hold any authenticated account - a self-registered Subscriber is sufficient - making stores with open customer registration directly exposed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a broken-access-control / IDOR flaw (CWE-639) with CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade the Wallet System for WooCommerce plugin to version 2.8.0 or later, which is the first release outside the affected range and resolves the missing ownership check; vendor guidance is available through the WPScan advisory at https://wpscan.com/vulnerability/fd44c88d-2ca4-4e3d-9e9f-570e239df4bd/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Woocommerce

View all
CVE-2017-17058 HIGH POC
7.5 Nov 29

The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
CVE-2021-24212 CRITICAL POC
9.8 Apr 05

The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
CVE-2022-50972 CRITICAL POC
9.3 Jun 20

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by

CVE-2020-35627 HIGH POC
8.8 Dec 28

Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
CVE-2026-14962 HIGH POC
8.6 Sep 09

Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
CVE-2026-92404 HIGH POC
7.5 Sep 19

Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync

CVE-2023-34000 HIGH POC
7.5 Jun 14

Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
CVE-2020-11497 HIGH POC
7.5 Aug 26

An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
CVE-2026-74925 HIGH POC
7.2 Sep 11

Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
CVE-2023-47777 MEDIUM POC
6.5 Nov 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
CVE-2026-103378 MEDIUM POC
6.5 Oct 07

Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
CVE-2026-93509 MEDIUM POC
6.5 Oct 08

Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2025-14998 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Share

CVE-2026-94245 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy