Wallet System for WooCommerce EUVD-2026-112620

Requires an authenticated WordPress session at minimal privilege (Subscriber or Customer) and that the plugin's KYC document submission feature is in use. The exploit works because the submission handler reads the target user ID from a client-supplied request field without an ownership or capability check. On a typical WooCommerce storefront with open customer registration, obtaining the required account is trivial, so the authentication requirement is a weak limiter. Limiting factors: the KYC/wallet verification feature must be active, the site must run a version before 2.8.2, and the attacker must already hold (or be able to create) an account - there is no unauthenticated path. Impact is limited to integrity of other users' KYC documents and verification status; it does not by itself disclose data or grant code execution.

This is a medium-severity access-control flaw (CWE-639, IDOR) with a vendor-style CVSS of 4.3 and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The signals are internally consistent and point to a moderate, not critical, priority: the vector is network-reachable with low attack complexity and no user interaction, but it requires privileges (PR:L) and the impact is confined to integrity (I:L) with no confidentiality or availability loss. The vuln.today decision label is 'this_month' rather than act_now/emergency, which aligns with the limited impact. It is NOT listed in CISA KEV and no EPSS exploitation-probability score was supplied, so there is no evidence of active or widespread exploitation. A public PoC reference exists (WPScan) but it is not verified as working exploit code. The main thing that elevates practical risk above the raw CVSS number is the low privilege bar combined with the typical WooCommerce deployment pattern: the required Subscriber/Customer role is trivially self-registered on most storefronts, and an attacker can target an administrator's KYC verification status. This is a genuine but contained authorization bug - prioritize patching this cycle, not as an emergency. No EPSS or SSVC automatable/technical-impact values were provided, so those axes could not be weighed.

On a WooCommerce store that allows customer self-registration and uses the plugin's KYC feature, an attacker signs up for an ordinary Customer/Subscriber account and submits the KYC document handler with another user's ID substituted into the client-supplied target field. Because the handler performs no ownership or capability check, the attacker overwrites the KYC documents and verification status of any chosen account, including an administrator. A public PoC reference exists (WPScan) but is not verified as working exploit code.