WooCommerce Wallet Plugin EUVD-2026-57171

Exploitation requires a registered and authenticated customer account on the targeted store (PR:L per CVSS vector - any user who can self-register qualifies). The Wallet System for WooCommerce plugin must be installed, active, and the wallet payment method must be enabled at checkout; stores with the plugin installed but the wallet method disabled at the WooCommerce payment settings level are not exploitable. No admin access, elevated privileges, or non-default configuration is required beyond the plugin being active in its intended use. Anonymous (unauthenticated) visitors cannot exploit this. The limiting factor is the low-privilege authentication requirement - attack surface is bounded to registered users, but on stores with open user registration this means any internet user qualifies.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately reflects the real-world risk: network-exploitable with low complexity, but gated behind an authenticated customer account (PR:L). The integrity impact is genuinely high - merchants receive no payment for fulfilled orders. No EPSS data was provided in the input, limiting quantitative exploitation-probability assessment; this gap should be noted by analysts. The vulnerability is not listed in the CISA KEV catalog, so active exploitation in the wild is not confirmed. However, a public proof-of-concept is confirmed by WPScan, which substantially lowers the exploitation barrier and makes this a realistic near-term threat. SSVC signals are concerning: exploitation is automatable (checkout manipulation is scriptable at scale), technical impact on the vulnerable system is high (direct financial loss to merchants), and operator awareness may be low given the plugin's niche footprint. This is a genuine operational priority for affected stores - not a high-CVSS-but-low-real-risk issue - because the combination of low attack complexity, public POC, and direct financial fraud motive creates strong attacker incentive.

A registered customer logs into a WooCommerce store, adds high-value items to their cart, and uses an HTTP proxy to intercept and modify the checkout POST request, setting the wallet deduction parameter to the full order total regardless of their actual wallet balance. The plugin processes the tampered amount without querying the stored balance, marks the order as fully paid, and the merchant fulfills the order having collected no funds. A public proof-of-concept is available, making this attack replicable without advanced technical skill.