{
 "id": "WPSEC-2026-2192",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2192/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2192/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2192/index.md",
 "title": "Wallet for WooCommerce <= 1.7.3 - Authenticated (Subscriber+) Referral Self-Referral Check Bypass via IP Address Spoofing",
 "description": "The Wallet for WooCommerce plugin for WordPress is vulnerable to referral reward abuse in versions 1.7.2 up to, and including, 1.7.3, due to the self-referral detection comparing IP addresses taken from client-supplied forwarded headers such as X-Forwarded-For, with no daily cap on visit rewards per referrer. This makes it possible for authenticated attackers, with subscriber-level access and above, to use additional customer accounts and spoofed IP addresses to collect referral rewards in their own referrer wallet. Exploitation requires the referral program to be enabled.",
 "plugin": {
  "slug": "woo-wallet",
  "name": "Wallet for WooCommerce",
  "full_name": "Wallet for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woo-wallet/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woo-wallet/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woo-wallet"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-348"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.7.2",
    "from_inclusive": true,
    "to": "1.7.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.7.2 before 1.7.4"
  ]
 },
 "introduced_in": "1.7.2",
 "fixed_in": "1.7.4",
 "remediation": "Update to 1.7.4 or later.",
 "fix_released": "2026-10-31T14:21:41+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:19:37.610674+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2192/",
  "https://plugins.svn.wordpress.org/woo-wallet/tags/1.7.4/",
  "https://wordpress.org/plugins/woo-wallet/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woo-wallet",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}