# Wallet System for WooCommerce <= 2.7.10 - Authenticated (Subscriber+) Insecure Direct Object Reference to Wallet Balance Transfer

- **ID:** WPSEC-2026-0569
- **Plugin:** Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments (`wallet-system-for-woocommerce`), https://wordpress.org/plugins/wallet-system-for-woocommerce/
- **Affected versions:** from 2.0.0 before 2.8.0
- **Fixed in:** 2.8.0 (Update to 2.8.0 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wallet-system-for-woocommerce
- **Fix released:** 2026-10-05
- **Published:** 2026-10-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0569/

## Description

The Wallet System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in the wallet balance transfer feature in versions 2.0.0 up to, and including, 2.7.10 due to the transfer handler using the user-supplied 'current_user_id' parameter as the source wallet without checking that it belongs to the requesting user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to transfer wallet balance out of other users' wallets into a wallet of their choice.

## References

- https://wpsec.com/vuln/WPSEC-2026-0569/
- https://plugins.svn.wordpress.org/wallet-system-for-woocommerce/tags/2.8.0/
- https://wordpress.org/plugins/wallet-system-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0569/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.