WordSec
WordSec

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.7.6 - Missing Authorization

2026-06-29 00:00
Evan NR

Strategic Overview

Status
Patched in 2.7.7
Affected PluginWallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments
Affected Version<= 2.7.6
CVSS4.3Medium
CVECVE-2026-57332
View all Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments vulnerabilities

Vulnerability Overview

The Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.7.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Technical Analysis

REMEDIATION: Update to version 2.7.7, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

External References

https://www.cve.org/CVERecord?id=CVE-2026-57332https://www.wordfence.com/threat-intel/vulnerabilities/id/86ca6f9f-5a04-4e56-a7c7-d18a0c6fdad4

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C

Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.7.6 - Missing Authorization (CVE-2026-57332)