CVE-2025-14450: WooCommerce Wallet System Auth Bypass Flaw

CVE-2025-14450 Overview

The Wallet System for WooCommerce plugin for WordPress contains a critical authorization bypass vulnerability due to a missing capability check on the change_wallet_fund_request_status_callback function. This flaw affects all versions up to and including 2.7.2, allowing authenticated attackers with minimal privileges (Subscriber-level access or above) to manipulate wallet withdrawal requests, arbitrarily increase their own wallet balance, or decrease other users' balances.

Critical Impact

Authenticated attackers can exploit this vulnerability to perform unauthorized financial manipulation, potentially stealing funds from e-commerce stores by increasing their wallet balance or depleting other users' accounts.

Affected Products

• Wallet System for WooCommerce plugin versions up to and including 2.7.2
• WordPress installations using the vulnerable plugin
• WooCommerce stores with wallet functionality enabled

Discovery Timeline

• 2026-01-17 - CVE-2025-14450 published to NVD
• 2026-01-17 - Last updated in NVD database

Technical Details for CVE-2025-14450

Vulnerability Analysis

This vulnerability falls under CWE-862 (Missing Authorization), a common weakness in web applications where critical functions lack proper access control checks. The vulnerable function change_wallet_fund_request_status_callback in the class-wallet-system-ajaxhandler.php file fails to verify whether the requesting user has the appropriate capabilities to modify wallet fund request statuses.

In WordPress plugins, AJAX handlers that modify sensitive data should implement capability checks using functions like current_user_can() to ensure only authorized users (typically administrators or shop managers) can execute privileged operations. The absence of this check creates a significant authorization bypass that can be exploited over the network without user interaction.

Root Cause

The root cause of this vulnerability is the missing capability check in the change_wallet_fund_request_status_callback function located at line 140 in the class-wallet-system-ajaxhandler.php file. The function processes wallet fund request status changes via AJAX without verifying that the authenticated user has the required permissions to perform such actions. Any authenticated user, regardless of their role, can invoke this function and manipulate wallet balances.

Attack Vector

The attack can be executed remotely over the network by any authenticated WordPress user with at least Subscriber-level access. The attacker would craft malicious AJAX requests targeting the vulnerable callback function to:

1. Approve their own wallet fund requests to artificially inflate their balance
2. Reject or manipulate other users' legitimate withdrawal requests
3. Modify wallet transaction statuses to redirect funds

The vulnerability exists in the AJAX handler at line 140 of class-wallet-system-ajaxhandler.php. The attack requires only basic authentication, making it accessible to anyone who can register an account on the affected WordPress site.

Detection Methods for CVE-2025-14450

Indicators of Compromise

• Unexpected changes in user wallet balances without corresponding legitimate transactions
• Unusual AJAX requests to change_wallet_fund_request_status_callback from non-administrator accounts
• Audit log entries showing wallet status changes initiated by low-privileged users
• Sudden discrepancies in wallet fund request approvals or rejections

Detection Strategies

• Monitor WordPress AJAX requests for calls to wallet-related callback functions from unauthorized user roles
• Implement logging for all wallet balance modifications and correlate with user permission levels
• Review WooCommerce transaction logs for suspicious wallet fund request status changes
• Set up alerts for multiple wallet operations performed in rapid succession

Monitoring Recommendations

• Enable comprehensive WordPress audit logging to track AJAX handler invocations
• Implement real-time monitoring of wallet balance changes across all user accounts
• Configure alerts for any wallet fund request status modifications by users without manage_woocommerce capability
• Regularly audit user roles and their associated permissions in relation to wallet functionality

How to Mitigate CVE-2025-14450

Immediate Actions Required

• Update the Wallet System for WooCommerce plugin to the latest patched version immediately
• Review all recent wallet transactions and fund request status changes for unauthorized modifications
• Audit user accounts for unexpected wallet balance increases, particularly subscriber-level accounts
• Consider temporarily disabling the wallet functionality until the patch is applied

Patch Information

A security patch has been released to address this vulnerability. The fix can be reviewed in the WordPress plugin changeset. Users should update to a version newer than 2.7.2 through the WordPress plugin update mechanism. Additional details are available in the Wordfence vulnerability report.

Workarounds

• Restrict user registration on the WordPress site to prevent attackers from obtaining authenticated access
• Implement a Web Application Firewall (WAF) rule to block AJAX requests to the vulnerable callback from non-administrator users
• Disable the wallet fund request feature temporarily via plugin settings until patched
• Remove subscriber-level and other low-privilege user accounts that are not essential

# Temporary mitigation: Restrict access to the vulnerable AJAX handler
# Add to .htaccess in WordPress root directory
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax.php$ [NC]
RewriteCond %{QUERY_STRING} action=change_wallet_fund_request_status [NC]
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in.*administrator [NC]
RewriteRule .* - [F,L]
</IfModule>