Vulnerabilities / Wallet for WooCommerce / WPSEC-2026-2192
Wallet for WooCommerce <= 1.7.3 - Authenticated (Subscriber+) Referral Self-Referral Check Bypass via IP Address Spoofing
Low 3.1
CWE-348Fixed in 1.7.4
- ID
- WPSEC-2026-2192
- Plugin
- Wallet for WooCommerce (woo-wallet)
- Affected
- from 1.7.2 before 1.7.4
- Remediation
- Update to 1.7.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-348
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Wallet for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Wallet for WooCommerce plugin for WordPress is vulnerable to referral reward abuse in versions 1.7.2 up to, and including, 1.7.3, due to the self-referral detection comparing IP addresses taken from client-supplied forwarded headers such as X-Forwarded-For, with no daily cap on visit rewards per referrer. This makes it possible for authenticated attackers, with subscriber-level access and above, to use additional customer accounts and spoofed IP addresses to collect referral rewards in their own referrer wallet. Exploitation requires the referral program to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2192/
- https://plugins.svn.wordpress.org/woo-wallet/tags/1.7.4/
- https://wordpress.org/plugins/woo-wallet/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS