MEDIUM 6.3 NVD

CVE-2026-94246

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user ma

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.

References

https://wpscan.com/vulnerability/20949357-8fe6-4151-88b8-15abdef292cb/

Published: 2026-10-08 · Source: NVD · Feed updated: 2026-10-12

This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-10-08 via NVD.

vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.