CVE-2026-93509
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.
| Vendor | unknown |
| Product | wallet system for woocommerce |
| Published | Oct 8, 2026 |
| Last Updated | Oct 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wallet system for woocommerce
Be the first to know when new medium vulnerabilities affecting unknown wallet system for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Wallet System for WooCommerce
2.0.0 < 2.8.0
References
Credits
Stefan Löwen (CODE WHITE GmbH) WPScan