CVE-2026-94246: Unknown Wallet System For Woocommerce

Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.

Affected products

• Unknown Wallet System For Woocommerce: from 2.0.0, before 2.8.0 (fixed in 2.8.0)

Published 2026-10-08. Last modified 2026-10-08.