CVE-2026-93509: Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Subscriber-level access can exploit it. No user interaction is required.
Which installations are affected?
Wallet System for WooCommerce versions before 2.8.0 are affected, including versions 2.0.0 through 2.7.10.
What can an attacker do?
An attacker can use a negative wallet transfer amount to mint funds in their own wallet or drain the balance of a specific victim into their own account.
What should be done if an upgrade cannot be applied immediately?
The provided data does not identify a workaround. Because Subscriber-level accounts are sufficient for exploitation, restricting or reviewing untrusted authenticated accounts may reduce exposure until version 2.8.0 or later can be deployed.