CVE-2024-13682 Overview
CVE-2024-13682 is a Cross-Site Request Forgery (CSRF) vulnerability in the Wallet System for WooCommerce plugin for WordPress, developed by wpswings. The flaw affects all plugin versions up to and including 2.6.2. The vulnerability stems from missing or incorrect nonce validation in class-wallet-user-table.php. Unauthenticated attackers can modify wallet balances by tricking a site administrator into clicking a crafted link. The weakness is classified under CWE-352.
Critical Impact
Successful exploitation lets attackers alter WooCommerce customer wallet balances without authentication, causing financial integrity loss on affected e-commerce sites.
Affected Products
- wpswings Wallet System for WooCommerce plugin — all versions up to and including 2.6.2
- WordPress sites running WooCommerce with the affected plugin installed
- Administrator sessions on sites with vulnerable plugin versions
Discovery Timeline
- 2025-03-04 - CVE-2024-13682 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13682
Vulnerability Analysis
The Wallet System for WooCommerce plugin manages customer wallet balances for cashback, refunds, and partial payments. The administrative interface for managing user wallets, implemented in class-wallet-user-table.php, processes state-changing operations without properly validating a WordPress nonce token. WordPress nonces are the intended defense against CSRF for privileged actions, and their absence here allows a cross-origin request to succeed if issued in the context of an authenticated administrator.
An attacker who lures an administrator to a malicious page can trigger a request that adjusts wallet balances. Because the action is server-authoritative and unlogged as an attacker action, the resulting balance changes appear to originate from the administrator. The confidentiality impact is none, but integrity of wallet data is affected.
Root Cause
The root cause is missing or improperly implemented nonce verification in the wallet user table handler. The plugin does not call wp_verify_nonce() or check_admin_referer() on the balance modification code path, so requests carrying only the administrator's session cookie are accepted regardless of origin.
Attack Vector
Exploitation requires user interaction. An attacker hosts a page or sends a link containing an auto-submitting form or image tag targeting the vulnerable plugin endpoint. When an authenticated WordPress administrator visits the page, the browser attaches session cookies to the forged request, and the plugin modifies the target wallet balance without further checks. No credentials, XSS, or prior foothold on the site are required.
The vulnerability manifests when the wallet management action handler in class-wallet-user-table.php processes POST or GET parameters without validating a nonce. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the code-level fix.
Detection Methods for CVE-2024-13682
Indicators of Compromise
- Unexplained changes to customer wallet balances that do not correspond to legitimate orders, refunds, or manual admin adjustments.
- Web server access logs showing administrator requests to wallet management endpoints with Referer headers pointing to external or suspicious domains.
- Wallet transaction records created during administrator browsing sessions that did not involve deliberate wallet edits.
Detection Strategies
- Review WooCommerce wallet audit logs and reconcile every balance modification against a known administrator action or customer order.
- Inspect HTTP request logs for POST requests to plugin admin pages missing WordPress nonce parameters such as _wpnonce.
- Correlate administrator authentication sessions with wallet update events to spot changes triggered from unexpected referrers.
Monitoring Recommendations
- Enable WordPress activity logging (for example, via a security plugin) to record all wallet balance edits with user, IP, and referrer context.
- Alert on wallet modifications performed outside business hours or from admin sessions with anomalous browsing patterns.
- Monitor the WordPress wp-admin request stream for cross-origin Referer and Origin headers on state-changing endpoints.
How to Mitigate CVE-2024-13682
Immediate Actions Required
- Update the Wallet System for WooCommerce plugin to a version later than 2.6.2 that includes the nonce validation fix.
- Audit all wallet balance changes made prior to patching and reverse any that cannot be tied to a legitimate transaction.
- Instruct administrators to log out of WordPress before browsing untrusted sites and to use a dedicated browser profile for admin work.
Patch Information
The vendor addressed the issue in the plugin trunk. Review the WordPress Plugin Changeset for the specific code changes that introduce nonce validation in class-wallet-user-table.php. Site owners should apply the update through the WordPress plugin manager and verify the installed version reflects the patched release.
Workarounds
- Deactivate the Wallet System for WooCommerce plugin until it can be updated on production sites.
- Restrict access to /wp-admin/ by source IP using web server rules or a WAF to reduce the exposure window for administrator sessions.
- Enforce short administrator session lifetimes and require re-authentication before wallet management actions.
# Example: restrict wp-admin access to a trusted IP using Apache
<Location /wp-admin>
Require ip 203.0.113.10
</Location>
# Example: verify installed plugin version via WP-CLI
wp plugin get wallet-system-for-woocommerce --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
