Unknown Wallet System For Woocommerce vulnerabilities

5 CVEs affecting Unknown Wallet System For Woocommerce, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-93509, published 2026-10-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-15045, published 2026-08-12. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated…
CVE-2026-93509, published 2026-10-08. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before…
CVE-2026-94244, published 2026-10-08. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before…
CVE-2026-94245, published 2026-10-08. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including…
CVE-2026-94246, published 2026-10-08. Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated…