Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.8.1 - Cross-Site Request Forgery to Repeated Partial Payment Wallet Refund

ID

WPSEC-2026-1450

Plugin

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments (wallet-system-for-woocommerce)

Affected

all versions before 2.8.2

Remediation

Update to 2.8.2 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness

CWE-352

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22

Attack surface

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments on WPSec AttackSurface

Fix released

2026-10-21

Published

2026-10-22

Description

The Wallet System for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery via the wps_wallet_refund_partial_payment AJAX action in all versions up to, and including, 2.8.1, due to missing nonce validation and no check on whether an order's partial payment was already refunded. This makes it possible for unauthenticated attackers to credit an order's partial wallet payment back to the customer's wallet, as many times as they like, by tricking a shop manager or administrator into performing an action such as clicking a link.

References

• https://wpsec.com/vuln/WPSEC-2026-1450/
• https://plugins.svn.wordpress.org/wallet-system-for-woocommerce/tags/2.8.2/
• https://wordpress.org/plugins/wallet-system-for-woocommerce/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS