CVE-2026-93509
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Oct 08, 2026
Vendor
unknown
Description
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.