CVE-2026-94245
Received Received - Intake

Unauthorized Wallet Balance Transfer in Wallet System for WooCommerce

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: WPScan

Description
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-94245
EUVD
EUVD-2026-94751

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Wallet System for WooCommerce 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Wallet System for WooCommerce plugin for WordPress. It allows any authenticated user, even with minimal Subscriber role privileges, to transfer funds from any other user's wallet, including administrators, into their own wallet without proper authorization checks.

Detection Guidance

To detect this vulnerability, check if the Wallet System for WooCommerce plugin is installed and its version is between 2.0.0 and 2.7.10. Verify if the plugin lacks proper authorization checks for wallet transfers. Review server logs for unauthorized wallet transfer attempts or unusual transactions.

Impact Analysis

An attacker could steal funds from other users' wallets, including administrators, by transferring balances to their own account. This could lead to financial loss for affected users and potential disruption of the WooCommerce store's operations.

Compliance Impact

This vulnerability could lead to unauthorized access and transfer of funds, which may violate data protection and financial regulations. It could result in non-compliance with GDPR (if personal data is involved) or other financial integrity standards due to the lack of proper access controls.

Mitigation Strategies

Immediately update the Wallet System for WooCommerce plugin to version 2.8.0 or later. If updating is not possible, disable the plugin until a patch is applied. Restrict user roles to prevent unauthorized access and monitor wallet transactions for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94245. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart