CVE-2026-94246: Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR

Q: Which users can exploit this issue?

Any authenticated user can exploit it, including a user with only Subscriber-level access. The attacker does not need access to the targeted user's wallet account.

Q: What does an attacker need to submit a forged withdrawal request?

The attacker needs to be able to authenticate to the WordPress site and submit a withdrawal request naming another user's wallet account. They can choose the requested amount and payout destination.

Q: What is the impact on the targeted wallet owner?

A forged request can be made against the victim's wallet and can indefinitely prevent that user from submitting their own withdrawal requests. The vulnerability is rated medium severity with CVSS 6.3.

Q: Which versions are affected?

Wallet System for WooCommerce versions 2.0.0 through 2.7.10 are affected. Versions before 2.8.0 do not verify that the wallet named in a withdrawal submission belongs to the submitting user.

Published Oct 8, 2026

Updated

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.

Affected Software

1 affected component

Wallet System for WooCommerce>=2.0.0<=2.7.10

Event History

Oct 8, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated user can exploit it, including a user with only Subscriber-level access. The attacker does not need access to the targeted user's wallet account.

What does an attacker need to submit a forged withdrawal request?

The attacker needs to be able to authenticate to the WordPress site and submit a withdrawal request naming another user's wallet account. They can choose the requested amount and payout destination.

What is the impact on the targeted wallet owner?

A forged request can be made against the victim's wallet and can indefinitely prevent that user from submitting their own withdrawal requests. The vulnerability is rated medium severity with CVSS 6.3.

Which versions are affected?

Wallet System for WooCommerce versions 2.0.0 through 2.7.10 are affected. Versions before 2.8.0 do not verify that the wallet named in a withdrawal submission belongs to the submitting user.

CVE-2026-94246: Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

What does an attacker need to submit a forged withdrawal request?

What is the impact on the targeted wallet owner?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What does an attacker need to submit a forged withdrawal request?

What is the impact on the targeted wallet owner?

Which versions are affected?