CVE-2026-108763: Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wallet System for WooCommerceto a version that resolves this vulnerability.Fixed in 2.8.2
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user with minimal privileges, including Subscriber or Customer accounts, can exploit it. The attacker does not need administrative privileges.
What does an attacker need to target another account?
The vulnerable handler accepts a target user ID supplied by the client and does not verify ownership or capabilities. An authenticated attacker can use this to target any user, including an administrator.
What can be changed through successful exploitation?
An attacker can overwrite another user's KYC documents and verification status. This can affect the integrity of identity-verification records for targeted accounts.
Are administrators protected from this issue?
No. The missing ownership and capability checks allow a minimally privileged authenticated user to overwrite the KYC data and verification status of an administrator account as well.