Wallet for WooCommerce

Wallet for WooCommerce has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 10 are fixed as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2024 was the busiest year with 4 disclosures.

The most common weakness is Missing Authorization, behind 3 of the records (30%). Other recurring categories include Cross-Site Request Forgery (CSRF), Authorization Bypass Through User-Controlled Key.

Every one of the 10 issues recorded for Wallet for WooCommerce has a vendor fix available, so running the current release closes all known holes.

9 independent researchers contributed these findings, most of them (2) reported by Muhammad Daffa. Wallet for WooCommerce is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891012.12.2017Today30.10.20228.8TeraWallet – For WooCommerce <= 1.3.24 - Cross-Site Request Forgery via lock_unlock_terawallet CVSS 8.8 · 30.10.202231.10.20224.3TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference CVSS 4.3 · 31.10.202215.02.20234.3TeraWallet – For WooCommerce <= 1.3.24 - Cross-Site Request Forgery via admin_options CVSS 4.3 · 15.02.202307.03.20244.3TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds <= 1.4.10 - Missing Authorization to Authenticated (Subscriber+) User Email Export CVSS 4.3 · 07.03.202424.04.20244.4TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds <= 1.5.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting CVSS 4.4 · 24.04.202411.07.20248.8Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]' CVSS 8.8 · 11.07.202427.11.20246.5Wallet for WooCommerce <= 1.5.6 - Authenticated (Subscriber+) Incorrect Conversion between Numeric Types CVSS 6.5 · 27.11.202420.02.20264.3TeraWallet – For WooCommerce <= 1.5.15 - Authenticated (Customer+) Race Condition CVSS 4.3 · 20.02.202610.07.20264.3Wallet for WooCommerce <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action CVSS 4.3 · 10.07.202610.08.20264.3TeraWallet - Wallet for WooCommerce <= 1.6.9 - Missing Authorization to Authenticated (Subscriber+) Wallet Balance Inflation CVSS 4.3 · 10.08.2026

Strategic Overview

Avg CVSSMedium
5.4/ 10
Patch Coverage100%
Open

0

Fixed

10

Get automatic notifications for all Wallet for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2024-6353

Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'

Read the full analysis

Vulnerability Records

10 records
2026-08-10 00:00CVE-2026-16538
4.3
Medium
Guillermo Álvarez FernándezYes
2026-07-10 17:34CVE-2026-12103
4.3
Medium
MitchellYes
2026-02-20 00:00CVE-2026-32398
4.3
Medium
b4shu206Yes
2024-11-27 00:00CVE-2024-7747
6.5
Medium
stealthcopterYes
2024-07-11 19:55CVE-2024-6353
8.8
High
1337_WannabeYes
2024-04-24 00:00CVE-2024-32584
4.4
Medium
Joshua ChanYes
2024-03-07 00:00CVE-2024-1690
4.3
Medium
Lucio SáYes
2023-02-15 00:00CVE-2022-40198
4.3
Medium
Muhammad DaffaYes
2022-10-31 00:00CVE-2022-3995
4.3
Medium
Marco WotschkaYes
2022-10-30 00:00CVE-2022-36401
8.8
High
Muhammad DaffaYes
Showing 1–10 of 10 reports
Wallet for WooCommerce banner
Latestv1.7.0

Wallet for WooCommerce

Subrata Mal

Author

Subrata Mal

4.7(188)
94/100
Last Updated
2026-09-11 (2d ago)
Active Installs
20,000+
Downloads
1,016,887
Requires WP
6.4+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2017-12-12 (9y ago)
Requires Plugins
woocommerce

Maximize convenience and savings for your customers with Wallet for WooCommerce (TeraWallet). This all-in-one digital wallet and store credit system is specifically designed to streamline the checkout process and boost customer loyalty. TeraWallet empowers your customers to deposit funds into their personal accounts, transfer money to other users, and make purchases effortlessly using their wallet balance. By reducing the need for repeated payment detail entries, you provide a frictionless shopping experience that encourages repeat business. Beyond core wallet functionality, TeraWallet features a robust Cashback Rewards System. Incentivize purchases by offering rewards based on cart totals, specific products, or categories. You can even convert WooCommerce coupons into wallet rewards, providing a unique way to drive engagement. 👉 Try the live demo: https://demo.standalonetech.com/ 👉 Read full documentation: https://docs.standalonetech.com/ 👉 Upgrade to Pro — unlock withdrawals, expiry, coupons, importer & AffiliateWP integration. ✨ Why choose Wallet for WooCommerce? 🚀 Frictionless Checkout: One-click payments via wallet balance reduce cart abandonment. 💰 Automated Cashback: Automated rewards keep customers coming back for more. 🏦 Store Credit System: Easily handle refunds by crediting the user’s wallet instantly. 🔄 Wallet Transfers: Allow customers to share funds with friends and family. 🛠 Features 🏦 Core Wallet Management: A centralized ledger system that tracks every credit and debit with 100% accuracy using SQL-level locking to prevent race conditions. 💰 Dynamic Cashback System: Cart-Wise: Rewards based on the total order value. Product-Wise: Granular control over rewards for individual items. Category-Wise: Rewards based on product taxonomies. 💳 Smart Checkout Options: Full Payment: Pay for the entire order using the wallet gateway. Partial Payment: Use wallet balance for part of the total and pay the rest via other gateways (Stripe, PayPal, etc.). Auto-Deduct: Automatically apply available balance as a discount at checkout. 🔄 User Empowerment: Wallet Top-ups: Customers can add funds via their dashboard using any supported payment method. Peer-to-Peer Transfers: Securely send wallet balance to other registered users via email. 🎁 Engagement Rewards: Credit users for specific actions: New user registration bonus. Daily login rewards. Product review rewards. 🛠 Admin Control Center: View all user balances and transaction history. Manually adjust (credit/debit) any user’s balance with detailed notes. Lock/Unlock user wallets for security and fraud prevention. 🔗 Seamless Integrations: Full support for WooCommerce Blocks checkout. Compatible with WPML and WooCommerce Subscriptions. Built-in support for Dokan, WCFM, and WCMarketplace. 🌍 Multi-Currency Support: First-class integrations with the most-used WooCommerce currency switchers. Wallet balances, top-ups, transfers, and cashback are all converted through the active provider’s live rates. YayCurrency – Multi-Currency Switcher WOOCS – WooCommerce Currency Switcher (FOX) WPML Multilingual & Multi-Currency (WCML) CURCY – Multi Currency for WooCommerce (VillaTheme) Aelia Currency Switcher Generic fallback for any other plugin that filters woocommerce_currency — active-currency detection still works, conversion falls open to the stored amount with an audit-log warning. 🚀 Pro Features ⭐ Upgrade to Pro to unlock advanced wallet features and specialized integrations: 💸 Wallet Withdrawal: Allow customers to request withdrawals from their wallet balance to their bank or other payment methods. ⌛ Wallet Expiry: Set expiration dates for wallet balance or cashback to encourage timely spending. 🎟️ Wallet Coupons: Create exclusive coupons that can only be redeemed into the user’s wallet. 📥 Wallet Importer: Easily bulk import wallet balances and transaction history from CSV files. 🤝 AffiliateWP Integration: Automatically credit affiliate commissions directly to the user’s wallet. 🎂 Milestone & Birthday Bonuses: Credit the wallet when a customer’s lifetime spend crosses a threshold you set, and once a year on their birthday. 📊 Breakage & Aging Reports: See how much wallet credit is about to expire, how much never will be spent, plus withdrawal and coupon reporting on the Wallet Dashboard. External services TeraWallet shows a dismissible admin notice inviting the administrator to join the StandaloneTech mailing list (release, security and compatibility news, tips, and occasional product news). Nothing is sent unless the administrator ticks the consent box (unticked by default) and submits the form. Only then, once, the plugin sends the entered email address, the site URL, the TeraWallet version and the time consent was given to https://standalonetech.com. No store, customer, order or wallet data is ever sent. Unsubscribe from any email. Terms of Service · Privacy Policy

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C