# Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.8.1 - Cross-Site Request Forgery to Repeated Partial Payment Wallet Refund

- **ID:** WPSEC-2026-1450
- **Plugin:** Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments (`wallet-system-for-woocommerce`), https://wordpress.org/plugins/wallet-system-for-woocommerce/
- **Affected versions:** all versions before 2.8.2
- **Fixed in:** 2.8.2 (Update to 2.8.2 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wallet-system-for-woocommerce
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1450/

## Description

The Wallet System for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery via the wps_wallet_refund_partial_payment AJAX action in all versions up to, and including, 2.8.1, due to missing nonce validation and no check on whether an order's partial payment was already refunded. This makes it possible for unauthenticated attackers to credit an order's partial wallet payment back to the customer's wallet, as many times as they like, by tricking a shop manager or administrator into performing an action such as clicking a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-1450/
- https://plugins.svn.wordpress.org/wallet-system-for-woocommerce/tags/2.8.2/
- https://wordpress.org/plugins/wallet-system-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1450/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.