CVE-2026-94245 in Wallet System for WooCommerce Plugin
Summary
by MITRE • 10/08/2026
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in Wallet System for WooCommerce prior to version 2.8.0 represents a critical failure in server-side authorization logic within a widely used WordPress e-commerce ecosystem plugin. This flaw fundamentally undermines the integrity of digital wallet balances by allowing unauthorized transfers between user accounts. The core technical issue stems from insufficient verification of ownership when processing transfer requests. Specifically, the application fails to validate that the authenticated user initiating the transaction is indeed the legitimate owner of the source wallet account being debited. Instead of binding the action strictly to the identity and permissions of the requestor relative to the target asset, the system relies on flawed assumptions or missing checks regarding resource ownership. This architectural weakness permits any logged-in individual with even minimal privileges, such as the default Subscriber role in WordPress, to manipulate financial data belonging to other users without restriction.
From a technical perspective, this vulnerability is classified under CWE-284 Improper Access Control and more specifically aligns with CWE-913 Improvement of Controls for Dynamic Resource Management where object-level permissions are not enforced correctly during state-changing operations. The attacker exploits the lack of server-side validation by crafting HTTP requests that specify arbitrary user IDs as the source of funds. Because the backend logic does not cross-reference these specified IDs against the session identity or database ownership records, it processes the transfer as valid. This allows for a complete bypass of intended access restrictions, effectively granting low-privilege users administrative-level financial control over high-privilege accounts, including those with Administrator roles who typically hold significant wallet balances in such systems.
The operational impact of this vulnerability is severe due to its direct implication on financial security and data integrity within the WooCommerce platform. An attacker can drain funds from any user account by transferring them to a controlled destination account. This capability extends beyond mere monetary loss; it also facilitates potential further exploitation chains, such as using stolen wallet balances to purchase malicious products or services that could compromise other parts of the system. Furthermore, because WordPress sites often handle sensitive customer data alongside financial transactions, this breach erodes trust and exposes merchants to significant liability under regulations like GDPR or PCI DSS if payment-related metadata is compromised during these illicit transfers. The ability to move arbitrary balances means there is no reliable audit trail for legitimate versus malicious activity unless additional logging mechanisms are externally implemented, which they typically are not by default in vulnerable versions.
Mitigation strategies must prioritize immediate patching and robust access control enforcement. Administrators running affected versions should upgrade the Wallet System plugin to version 2.8.0 or later immediately, as this release addresses the authorization check failures. In environments where upgrading is temporarily delayed due to compatibility concerns with other plugins, temporary mitigations include restricting user registration if possible, implementing Web Application Firewall rules that monitor for anomalous patterns in wallet transfer endpoints, and enforcing strict role-based access control policies that limit who can interact with financial modules. Long-term remediation involves adopting a defense-in-depth approach where all state-changing operations undergo rigorous server-side validation of resource ownership against the authenticated user's identity before execution. This aligns with ATT&CK technique T1078 Valid Accounts, as attackers leverage legitimate credentials to perform unauthorized actions that should be blocked by proper access control mechanisms. Ensuring that every API endpoint and form submission verifies both authentication status and authorization rights for specific resources is essential to prevent similar privilege escalation vulnerabilities in future developments.