9.1
Critical
CVE-2026-16538 The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet…
Description
The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Wallet for WooCommerce 1.6 | earliest → < 1.6.10 | 1.6.10 |