WordPress plugin
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 17 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium17
- Low0
All Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Authenticated (Subscriber+) Insecure Direct Object Reference ≤2.8.1Update to 2.8.2 | CVE-2026-108763 | |
| Medium4.3 | Authenticated (Subscriber+) Insecure Direct Object Reference <2.8.0Update to 2.8.0 | CVE-2026-94245 | |
| Medium4.3 | Missing Authorization <2.8.0Update to 2.8.0 | CVE-2026-94244 | |
| Medium4.3 | Authenticated (Subscriber+) Insecure Direct Object Reference <2.8.0Update to 2.8.0 | CVE-2026-94246 | |
| Medium6.3 | Authenticated (Subscriber+) Fraudulent Wallet Balance Manipulation <2.8.0Update to 2.8.0 | — | |
| Medium6.3 | 2.7.10 - Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation 2.0.0 – 2.7.10Update to 2.8.0 | CVE-2026-93509 | |
| Medium4.3 | Unauthenticated Payment Bypass <2.7.10Update to 2.7.10 | CVE-2026-15045 | |
| Medium4.3 | Missing Authorization ≤2.7.6Update to 2.7.7 | CVE-2026-57332 | |
| Medium4.3 | Missing Authorization ≤2.7.5Update to 2.7.6 | CVE-2026-42654 | |
| Medium6.5 | Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation ≤2.7.2Update to 2.7.3 | CVE-2025-14450 | |
| Medium4.3 | Authenticated (Subscriber+) Information Exposure ≤2.7.3Update to 2.7.4 | CVE-2025-68029 | |
| Medium4.3 | Cross-Site Request Forgery ≤2.6.7Update to 2.6.8 | CVE-2025-54041 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤2.6.8Update to 2.6.9 | CVE-2025-32530 | |
| Medium4.3 | Cross-Site Request Forgery ≤2.6.2Update to 2.6.3 | CVE-2024-13682 | |
| Medium4.3 | Missing Authorization ≤2.6.2Update to 2.6.3 | CVE-2024-13724 | |
| Medium5.3 | Information Exposure via Log Files ≤2.5.13Update to 2.5.14 | CVE-2024-38699 | |
| Medium4.3 | Cross-Site Request Forgery ≤2.5.9Update to 2.5.10 | CVE-2024-32446 |
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤2.8.1Update to 2.8.2
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
<2.8.0Update to 2.8.0
- Medium4.3Missing Authorization
<2.8.0Update to 2.8.0
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
<2.8.0Update to 2.8.0
- Medium6.3Authenticated (Subscriber+) Fraudulent Wallet Balance Manipulation
<2.8.0Update to 2.8.0
- Medium6.32.7.10 - Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation
2.0.0 – 2.7.10Update to 2.8.0
- Medium4.3Unauthenticated Payment Bypass
<2.7.10Update to 2.7.10
- Medium4.3Missing Authorization
≤2.7.6Update to 2.7.7
- Medium4.3Missing Authorization
≤2.7.5Update to 2.7.6
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation
≤2.7.2Update to 2.7.3
- Medium4.3Authenticated (Subscriber+) Information Exposure
≤2.7.3Update to 2.7.4
- Medium4.3Cross-Site Request Forgery
≤2.6.7Update to 2.6.8
- Medium6.1Reflected Cross-Site Scripting
≤2.6.8Update to 2.6.9
- Medium4.3Cross-Site Request Forgery
≤2.6.2Update to 2.6.3
- Medium4.3Missing Authorization
≤2.6.2Update to 2.6.3
- Medium5.3Information Exposure via Log Files
≤2.5.13Update to 2.5.14
- Medium4.3Cross-Site Request Forgery
≤2.5.9Update to 2.5.10
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments: common questions
Does Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments have known vulnerabilities?
Yes. VulnCrest Radar lists 17 known vulnerabilities in Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments: 17 medium. None are known to affect version null.
How do I check which version of Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments vulnerability?
CVE-2026-108763, published Oct 27, 2026: Wallet System for WooCommerce <= 2.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference. Severity: Medium (CVSS 4.3).
Is any Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments vulnerability listed in CISA KEV?
No. None of the known Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments vulnerabilities is currently listed in the CISA KEV catalog.