Description

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-08T11:16:47.217Z",
  "pubdate": "2026-10-08T11:16:47.217Z",
  "executiveSummary": "The Wallet System for WooCommerce WordPress plugin, in versions prior to 2.8.0, is susceptible to a critical financial logic flaw. This vulnerability encompasses both improper input validation and a race condition resulting from stale state snapshots during balance transfers.\nAn authenticated user with minimal privileges (Subscriber) can exploit these flaws to perform unauthorized balance manipulation. The vulnerability allows an attacker to either arbitrarily mint new wallet funds or conduct a balance-draining attack against specific victim accounts, transferring those funds to their own controlled wallet.\nThe root cause lies in the application's failure to enforce positive-value constraints on transfer amounts and its reliance on inconsistent state verification during the transaction lifecycle. This compromise threatens the financial integrity of the WooCommerce store, posing significant risks of monetary loss and database manipulation. Successful exploitation requires an active user session but does not necessitate high-level administrative permissions, making it a high-risk security flaw for any e-commerce deployment utilizing this plugin.",
  "technicalDetails": "The vulnerability in the Wallet System for WooCommerce plugin is primarily attributed to a failure in server-side input validation and an atomic transaction failure during the wallet transfer process. In versions prior to 2.8.0, the transaction logic fails to verify that the transfer amount provided by the user is a positive integer or float.\nBy submitting a negative value or zero-value payload, an attacker can manipulate the arithmetic logic responsible for calculating the sender and recipient balances. Because the system performs balance updates based on a stale snapshot of the sender's account state, the application experiences a race condition or logic bypass when calculating the new balance post-transfer. Specifically, if the system does not properly lock the database records during the read-modify-write cycle, the balance update calculation is performed against a version of the data that does not reflect the concurrent credit being applied to the recipient.\nThe attack flow for minting funds involves an authenticated attacker interacting with the transfer function using a negative input value. When the server processes this negative transfer, the arithmetic operation (New Balance = Current Balance - Transfer Amount) effectively results in an addition to the attacker's balance, bypassing standard deduction logic. Alternatively, by targeting a victim's user ID, an attacker can manipulate the transfer requests to force a balance drain, effectively moving funds from an arbitrary account into their own.\nThis vulnerability resides within the transaction handling functions of the plugin. The lack of strict type checking and range validation for the 'amount' parameter allows attackers to bypass business logic constraints. Furthermore, the absence of proper synchronization or transactional integrity (e.g., using SQL transactions or row-level locking) ensures that the balance snapshot used for the calculation is consistently outdated relative to the actual state of the wallet ledger.\nBecause the vulnerability is reachable by any authenticated Subscriber, the attack vector is localized to the application's web interface. The post-exploitation impact is severe, as it enables direct financial theft and the creation of fraudulent currency within the ecosystem, leading to potential revenue loss for the store owner and compromise of user trust."
}