Description

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T12:17:46.563Z",
  "pubdate": "2026-08-12T12:17:46.563Z",
  "executiveSummary": "The Wallet System for WooCommerce WordPress plugin before 2.7.10 suffers from a business logic vulnerability involving insufficient server-side validation of financial parameters during the checkout process.\nSpecifically, the application fails to validate the user-supplied wallet deduction amount against the customer's actual stored balance in the database.\nThis security flaw allows authenticated malicious actors to manipulate transaction parameters, arbitrarily reducing their order totals—potentially down to zero—and completing purchases without executing valid financial transactions.\nThe impact includes direct financial loss for merchants, unauthorized acquisition of goods or services, and potential inventory depletion.\nThe vulnerability requires authenticated access to the platform and exploitation of the client-to-server request parameters during the checkout workflow.\nThe risk implication is critical for e-commerce platforms utilizing vulnerable versions of the plugin, as it facilitates direct monetization bypass attacks by standard users without requiring elevated privileges.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure client-side trust model and a lack of server-side state verification within the Wallet System for WooCommerce WordPress plugin before 2.7.10.\nDuring the checkout phase, the plugin accepts a user-supplied parameter representing the wallet amount to be applied toward the current order total.\nDue to improper input validation and missing integrity checks, the backend processing logic blindly trusts the incoming wallet debit amount provided in the HTTP request rather than querying the database to verify the authenticated customer's actual stored balance.\nAn authenticated attacker can leverage this flaw by intercepting the checkout HTTP request using an interception proxy and modifying the wallet amount parameter to match or exceed the total order cost.\nThe attack flow proceeds as follows: First, the attacker adds items to the WooCommerce cart and navigates to the checkout page. Second, during the final payment submission, the attacker alters the wallet deduction value within the POST request parameters to an arbitrary figure. Third, the vulnerable backend logic processes the transaction by subtracting the manipulated wallet value from the order total without enforcing balance constraints or reconciling the requested deduction against the user's ledger.\nConsequently, the order status transitions to complete or processing, bypassing payment gateways entirely while debiting zero or an incorrect amount from the user's actual wallet.\nThe vulnerable component is the wallet processing and checkout handler within the Wallet System for WooCommerce plugin.\nPrerequisites for this attack include network access to the target e-commerce store, a registered and authenticated customer account, and the ability to manipulate HTTP parameters during the checkout sequence."
}