Improper Wallet Transfer Authorization in WooCommerce Plugin by WordPress
CVE-2026-94245

Currently unrated

Key Information:

Vendor

WordPress
Status
Wallet System For WooCommerce
Vendor
CVE Published:
8 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-94245?

The Wallet System for WooCommerce plugin for WordPress prior to version 2.8.0 contains a security flaw that permits authenticated users to execute wallet transfers without the necessary permissions. Specifically, this vulnerability allows any authenticated individual, including those with minimal privileges such as the Subscriber role, to transfer funds from any user's wallet, potentially affecting administrators as well. This lack of ownership verification can lead to unauthorized manipulation of wallet balances, which poses significant risks to user accounts and system integrity.

Affected Version(s)

Wallet System for WooCommerce 2.0.0 < 2.8.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-94245 - Proof of Concept

References

https://wpscan.com/vulnerability/fd44c88d-2ca4-4e3d-9e9f-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Stefan Spasic
WPScan
.