CVE-2026-93509
Received Received - Intake

Wallet Balance Manipulation in WooCommerce Wallet System

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: WPScan

Description
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-93509
EUVD
EUVD-2026-94830

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Wallet System for WooCommerce 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Wallet System for WooCommerce plugin before version 2.8.0 has a flaw where it does not check if wallet transfer amounts are positive. This allows authenticated users with Subscriber access to either create funds for themselves or drain another user's wallet balance into their own account. The issue happens because the plugin calculates the sender's new balance using outdated data before crediting the recipient.

Detection Guidance

Check the installed version of the Wallet System for WooCommerce plugin. If it is between 2.0.0 and 2.7.10, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' if using WP-CLI to verify the version.

Impact Analysis

If you use the vulnerable plugin version, an attacker with Subscriber access could steal funds from your wallet or create unlimited funds for themselves. This could lead to financial losses or unauthorized transactions affecting your business or personal finances.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling unauthorized financial transactions. An attacker could manipulate wallet balances, leading to improper financial data handling or fraudulent activities. Such actions may violate data integrity and security requirements under these regulations.

Mitigation Strategies

Update the Wallet System for WooCommerce plugin to version 2.8.0 or later immediately. Remove or disable the plugin if updating is not possible. Restrict Subscriber-level user permissions to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93509. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart