Cross-Site Request Forgery Vulnerability in Wallet System for WooCommerce Plugin

CVE-2024-13682

What is CVE-2024-13682?

The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress contains a Cross-Site Request Forgery vulnerability present in all versions up to and including 2.6.2. This vulnerability arises from inadequate nonce validation in the class-wallet-user-table.php file, allowing unauthenticated attackers to potentially modify wallet balances. The exploit requires the attacker to deceive a site administrator into interacting with a malicious link, thus executing unauthorized actions.

References