Vulnerabilities / Wallet System for WooCommerce / WPSEC-2026-0570
Wallet System for WooCommerce <= 2.7.10 - Authenticated (Subscriber+) Insecure Direct Object Reference to Wallet Withdrawal Requests
Medium 4.3
CWE-639Fixed in 2.8.0
- ID
- WPSEC-2026-0570
- Plugin
- Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments (wallet-system-for-woocommerce)
- Affected
- from 2.0.0 before 2.8.0
- Remediation
- Update to 2.8.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-07
- Attack surface
- Wallet System for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Wallet System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in the wallet withdrawal request feature in versions 2.0.0 up to, and including, 2.7.10 due to the withdrawal handler trusting the user-supplied 'wallet_user_id' parameter and saving every submitted form field on the request. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit withdrawal requests against other users' wallets, which debit the victim's wallet if an administrator approves them, and to set the withdrawal fee recorded on their requests.
References
- https://wpsec.com/vuln/WPSEC-2026-0570/
- https://plugins.svn.wordpress.org/wallet-system-for-woocommerce/tags/2.8.0/
- https://wordpress.org/plugins/wallet-system-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS