CVE-2026-93509 — Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount

CVE-2026-93509

Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount PUBLISHED

Description (CNA)

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.

Affected (CNA)

Vendor / product	Versions
Unknown / Wallet System for WooCommerce	affected 2.0.0 before 2.8.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/a31138af-234e-44c8-bced-9058553a8b81/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.