Veille CVE

Recherche « Unknown Wallet for WooCommerce »

9 CVE

Critique 1 Élevée 1 Moyenne 7 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Wallet for WooCommerce » ✕
  1. CVE-2026-103307 8.6 Élevée

    Unknown Walletdoc Payment Gateway for WooCommerce

    The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.

  2. CVE-2026-93509 6.5 Moyenne

    Unknown Wallet System for WooCommerce

    The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.

  3. CVE-2026-94246 6.3 Moyenne

    Unknown Wallet System for WooCommerce

    The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.

  4. CVE-2026-94245 6.5 Moyenne

    Unknown Wallet System for WooCommerce

    The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.

  5. CVE-2026-94244 4.3 Moyenne

    Unknown Wallet System for WooCommerce

    The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user, such as a subscriber, to disclose all users' names, email addresses, roles, transaction amounts, payment methods and dates.

  6. CVE-2026-93510 4.3 Moyenne

    Unknown Points and Rewards for WooCommerce

    The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.

  7. CVE-2026-15045 6.5 Moyenne

    Unknown Wallet System for WooCommerce

    The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.

  8. CVE-2026-16538 9.1 Critique

    Unknown Wallet for WooCommerce

    The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.

  9. CVE-2026-11782 5.9 Moyenne

    Unknown Points and Rewards for WooCommerce

    The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated attackers to arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce Points and Rewards for WooCommerce WordPress plugin before 2.10.1 to be active.