Authorization Bypass in Wallet System for WooCommerce by WordPress
CVE-2026-108763
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 29 October 2026
Badges
What is CVE-2026-108763?
The Wallet System for WooCommerce plugin for WordPress prior to version 2.8.2 is susceptible to an authorization bypass issue. This vulnerability allows authenticated users with minimum permissions, such as Subscribers or Customers, to manipulate the KYC document submission handler. Since the plugin takes the target user ID from an unvalidated client-supplied request, it enables these users to overwrite the KYC documents and verification statuses of any user, including those with higher privileges like administrators. As a result, this poses a significant security risk, allowing unauthorized access to sensitive user information.
Affected Version(s)
Wallet System for WooCommerce 0 < 2.8.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.