CVE-2026-93509 Details
Description
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.
A vulnerability exists in the Wallet System for WooCommerce WordPress plugin in versions prior to 2.8.0. The plugin fails to ensure that wallet transfer amounts are positive and calculates the sender's new balance based on an outdated snapshot taken before the recipient is credited. This flaw allows an authenticated attacker with Subscriber-level access to either create wallet funds for themselves or transfer a specific victim's balance into their own account.
Users are advised to update the Wallet System for WooCommerce WordPress plugin to version 2.8.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/a31138af-234e-44c8-bced-9058553a8b81/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Wallet System | >= 2.0.0, <= 2.7.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | New CVE Received | [email protected] |
| Oct 8, 2026 | CVE Modified | CISA-ADP |