CVE-2026-93509: Unknown Wallet System For Woocommerce

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.

Affected products

• Unknown Wallet System For Woocommerce: from 2.0.0, before 2.8.0 (fixed in 2.8.0)

Published 2026-10-08. Last modified 2026-10-08.