CVE-2026-93509 | BDVDB-2026-384609 Detail

Description#

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-08Record published in the CVE List.