{
 "id": "WPSEC-2026-1450",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1450/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1450/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1450/index.md",
 "title": "Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.8.1 - Cross-Site Request Forgery to Repeated Partial Payment Wallet Refund",
 "description": "The Wallet System for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery via the wps_wallet_refund_partial_payment AJAX action in all versions up to, and including, 2.8.1, due to missing nonce validation and no check on whether an order's partial payment was already refunded. This makes it possible for unauthenticated attackers to credit an order's partial wallet payment back to the customer's wallet, as many times as they like, by tricking a shop manager or administrator into performing an action such as clicking a link.",
 "plugin": {
  "slug": "wallet-system-for-woocommerce",
  "name": "Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments",
  "full_name": "Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments",
  "wordpress_org": "https://wordpress.org/plugins/wallet-system-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wallet-system-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wallet-system-for-woocommerce"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.8.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.8.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.8.2",
 "remediation": "Update to 2.8.2 or later.",
 "fix_released": "2026-10-21T12:55:26+00:00",
 "published": "2026-10-22T13:52:08+00:00",
 "updated": "2026-10-22T11:27:10.865378+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1450/",
  "https://plugins.svn.wordpress.org/wallet-system-for-woocommerce/tags/2.8.2/",
  "https://wordpress.org/plugins/wallet-system-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wallet-system-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-22"
 }
}