Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Authenticated (Subscriber+) Fraudulent Wallet Balance Manipulation

The Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments plugin for WordPress is vulnerable to Improper Input Validation in all versions up to 2.8.0. This is due to missing validation that the wallet transfer amount is a positive number, and reuse of a stale wallet balance snapshot (read before the recipient is credited) when debiting the sender, combined with a client-supplied user ID accepted in place of the authenticated session user. This makes it possible for authenticated attackers, with subscriber-level access and above, to mint wallet funds for themselves or drain another user's wallet balance into their own account by supplying a negative or zero transfer amount and exploiting the stale pre-credit balance snapshot used when debiting the sender.

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: Wallet System for WooCommerce 2.8.0 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts