CVE-2026-108763mediumCWE-639

CVE-2026-108763: fallo de gravedad media en Wallet System for WooCommerce

Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR

Publicada el

Seguir esta CVE+ Monitorear Wallet System for WooCommerce

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 4.3epss 0.2%
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Productos afectados
Unknown · Wallet System for WooCommerce
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Wallet System for WooCommerce

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-15045MEDIUMWallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet AmountEPSS 0.3%CVE-2026-93509MEDIUMWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer AmountEPSS 0.2%CVE-2026-94244MEDIUMWallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via ExportEPSS 0.2%CVE-2026-94245MEDIUMWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOREPSS 0.2%CVE-2026-94246MEDIUMWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOREPSS 0.2%