6.5
Medium
CVE-2026-93509 The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is…
Description
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Wallet System for WooCommerce 2.0 | 2.0.0 → < 2.8.0 | 2.8.0 |
Other CVEs of Wallet System for WooCommerce
The 6 CVEs of Wallet System for WooCommerce →
CVE-2026-108763
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler…
4.3
Medium
CVE-2026-94246
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a…
6.3
Medium
CVE-2026-94245
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet…
6.5
Medium
CVE-2026-94244
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on…
4.3
Medium