Vulnerabilities / Wallet System for WooCommerce / WPSEC-2026-0569
Wallet System for WooCommerce <= 2.7.10 - Authenticated (Subscriber+) Insecure Direct Object Reference to Wallet Balance Transfer
Medium 6.5
CWE-639Fixed in 2.8.0
- ID
- WPSEC-2026-0569
- Plugin
- Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments (wallet-system-for-woocommerce)
- Affected
- from 2.0.0 before 2.8.0
- Remediation
- Update to 2.8.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-07
- Attack surface
- Wallet System for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Wallet System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in the wallet balance transfer feature in versions 2.0.0 up to, and including, 2.7.10 due to the transfer handler using the user-supplied 'current_user_id' parameter as the source wallet without checking that it belongs to the requesting user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to transfer wallet balance out of other users' wallets into a wallet of their choice.
References
- https://wpsec.com/vuln/WPSEC-2026-0569/
- https://plugins.svn.wordpress.org/wallet-system-for-woocommerce/tags/2.8.0/
- https://wordpress.org/plugins/wallet-system-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS