Skip to main content

WooCommerce Wallet System EUVDEUVD-2026-94752

| CVE-2026-94246 MEDIUM
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-10-08 contact@wpscan.com GHSA-cgxq-x82m-q3wm
WordPress Authentication Bypass Woocommerce
6.3
CVSS 3.1 · Vendor: wpscan
Share

Severity by source

Vendor (wpscan) PRIMARY
6.3 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
vuln.today AI
7.1 HIGH

Authenticated subscriber (PR:L) exploits a network IDOR (AV:N/AC:L) with no victim interaction to file the request (UI:N); I:H via payout/amount redirection, A:L via withdrawal lockout, C:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (wpscan).

CVSS VectorVendor: wpscan

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low

Lifecycle Timeline

6
Metadata Corrected
Oct 08, 2026 - 11:40 vuln.today
tag: Woocommerce added
Analysis Generated
Oct 08, 2026 - 11:31 vuln.today
CVSS changed
Oct 08, 2026 - 11:22 NVD
6.3 (MEDIUM)
Patch available
Oct 08, 2026 - 07:01 EUVD
CVE Published
Oct 08, 2026 - 06:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Oct 08, 2026 - 06:16 cve.org
MEDIUM 6.3

DescriptionCVE.org

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.

AnalysisAI

Insufficient authorization in the Wallet System for WooCommerce WordPress plugin before 2.8.0 lets any authenticated user - a subscriber-level account is sufficient - file a withdrawal request against another user's wallet while freely choosing the amount and the payout destination. Because the plugin never checks that the wallet named in the submission belongs to the submitter, the attacker can also repeatedly lodge requests that indefinitely block the victim from making legitimate withdrawals of their own, producing an immediate denial-of-service effect even when no funds move. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Prerequisite: the Wallet System for WooCommerce plugin (versions 2.0.0 through 2.7.x) must be active, and the attacker must hold any authenticated account - subscriber-level is sufficient, which is realistic on stores that permit open WooCommerce customer registration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine but bounded risk, not a drop-everything emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: upgrade the Wallet System for WooCommerce plugin to version 2.8.0 or later - this is the primary and complete fix, and WPScan's advisory at https://wpscan.com/vulnerability/20949357-8fe6-4151-88b8-15abdef292cb/ should be used to verify the release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Woocommerce

View all
CVE-2017-17058 HIGH POC
7.5 Nov 29

The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
CVE-2021-24212 CRITICAL POC
9.8 Apr 05

The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
CVE-2022-50972 CRITICAL POC
9.3 Jun 20

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by

CVE-2020-35627 HIGH POC
8.8 Dec 28

Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
CVE-2026-14962 HIGH POC
8.6 Sep 09

Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
CVE-2026-92404 HIGH POC
7.5 Sep 19

Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync

CVE-2023-34000 HIGH POC
7.5 Jun 14

Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
CVE-2020-11497 HIGH POC
7.5 Aug 26

An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
CVE-2026-74925 HIGH POC
7.2 Sep 11

Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
CVE-2023-47777 MEDIUM POC
6.5 Nov 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
CVE-2026-103378 MEDIUM POC
6.5 Oct 07

Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
CVE-2026-93509 MEDIUM POC
6.5 Oct 08

Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2025-14998 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Share

EUVD-2026-94752 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy