CVE-2026-94245

6.5 Moyenne

Publiée le 08/10/2026 à 08:16 · Modifiée le 08/10/2026 à 22:51 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.

Traduire en français

Produits concernés

Unknown Wallet System for WooCommerce

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N`

Faiblesses (CWE)

CWE-639

Références

https://wpscan.com/vulnerability/fd44c88d-2ca4-4e3d-9e9f-570e239df4bd/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories