CVE-2026-108763mediumCWE-639

CVE-2026-108763: falha de média gravidade em Wallet System for WooCommerce

Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR

Publicada em

Seguir esta CVE+ Monitorar Wallet System for WooCommerce

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

33Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 4.3epss 0.2%
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Unknown · Wallet System for WooCommerce
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Wallet System for WooCommerce

No mesmo produto, das mais perigosas para as menos.

CVE-2026-15045MEDIUMWallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet AmountEPSS 0.3%CVE-2026-93509MEDIUMWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer AmountEPSS 0.2%CVE-2026-94244MEDIUMWallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via ExportEPSS 0.2%CVE-2026-94245MEDIUMWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOREPSS 0.2%CVE-2026-94246MEDIUMWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOREPSS 0.2%