CVE-2026-108763: medium-severity vulnerability in Wallet System for WooCommerce
Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 4.3epss 0.2%
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Wallet System for WooCommercepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/78a72702-c7c1-4f9a-a832-339e04011e34/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Wallet System for WooCommerce
In the same product, most dangerous first.
CVE-2026-15045MEDIUMWallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet AmountEPSS 0.3%CVE-2026-93509MEDIUMWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer AmountEPSS 0.2%CVE-2026-94244MEDIUMWallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via ExportEPSS 0.2%CVE-2026-94245MEDIUMWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOREPSS 0.2%CVE-2026-94246MEDIUMWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOREPSS 0.2%