CVE-2026-94246
Received Received - Intake

Unauthorized Wallet Withdrawal in WooCommerce Wallet System

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: WPScan

Description
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-94246
EUVD
EUVD-2026-94752

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Wallet System for WooCommerce 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Insecure Direct Object Reference (IDOR) flaw in the Wallet System for WooCommerce plugin. It allows any authenticated user, including low-privilege subscribers, to submit a withdrawal request on behalf of another user. The attacker can choose the withdrawal amount and payout destination, and may block the victim's wallet from future withdrawals.

Detection Guidance

Check the installed version of the Wallet System for WooCommerce plugin. If it is between 2.0.0 and 2.7.10, the system is vulnerable. Review withdrawal logs for unauthorized transactions or blocked wallet submissions.

Impact Analysis

If you use the affected plugin versions, an attacker could drain funds from your wallet by submitting unauthorized withdrawals. Your wallet may also be blocked from submitting future withdrawals, preventing you from accessing your own funds.

Compliance Impact

This vulnerability could lead to unauthorized access to user wallet funds, potentially violating data protection principles under GDPR (e.g., unauthorized processing of personal data) and HIPAA (e.g., unauthorized transactions involving financial data).

Mitigation Strategies

Update the Wallet System for WooCommerce plugin to version 2.8.0 or later immediately. Review recent withdrawal requests for suspicious activity and revoke unauthorized transactions if detected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94246. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart