6.5
Moyenne
CVE-2026-93509 The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is…
Description
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Wallet System for WooCommerce 2.0 | 2.0.0 → < 2.8.0 | 2.8.0 |
Autres CVE de Wallet System for WooCommerce
Les 6 CVE de Wallet System for WooCommerce →
CVE-2026-108763
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler…
4.3
Moyenne
CVE-2026-94246
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a…
6.3
Moyenne
CVE-2026-94245
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet…
6.5
Moyenne
CVE-2026-94244
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on…
4.3
Moyenne