Read the docs
TI-2026-69473 Aliases CVE-2026-94244

Wallet System for WooCommerce exposes all wallet transactions

Priority LOW 19CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-200.

Summary

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not check user capabilities before generating a report of wallet transactions. Any authenticated user can obtain the token the report requires from a front-end page, which exposes sensitive information (CWE-200) to users who should not see it. An authenticated user with a subscriber role can see the names, email addresses, roles, transaction amounts, payment methods and dates of all customers. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user, such as a subscriber, to disclose all users' names, email addresses, roles, transaction amounts, payment methods and dates.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00176 7th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Wallet System for WooCommerce (Unknown): 2.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWallet System for WooCommercebefore 2.8.02.8.0Patch availableCNA
  • Wallet System for WooCommerce VendorUnknown Affected before 2.8.0 Fixed in 2.8.0 Patch available CNA

Remediation

Update Wallet System for WooCommerce to version 2.8.0, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Wallet System for WooCommerce (Unknown) Fixed in 2.8.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Wallet System for WooCommerce 2.8.0

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-69474 Wallet System for WooCommerce lets users steal other users' balancesPriority LOW 28
    • TI-2026-69471 Wallet System for WooCommerce flaw lets subscribers alter balancesPriority LOW 28
    • TI-2026-69475 Wallet System for WooCommerce lets users withdraw from others' walletsPriority LOW 27
    Show all 4 records →

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-94244

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences