CVE-2026-12103: Wallet for WooCommerce Auth Bypass Flaw

CVE-2026-12103 Overview

CVE-2026-12103 is an authorization bypass vulnerability in the Wallet for WooCommerce plugin for WordPress affecting all versions up to and including 1.6.4. The plugin fails to verify that a requesting user is authorized to invoke a user-search AJAX handler. Authenticated attackers with Subscriber-level access can enumerate the login name, email address, and user ID of any WordPress account, including administrators. The required search-user nonce is localized into the wallet_param object on the standard WooCommerce My Account page, making it trivially obtainable by any authenticated user. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
Any Subscriber-level user can harvest administrator usernames and email addresses, enabling targeted credential-stuffing and phishing campaigns against high-privilege accounts.

Affected Products

Wallet for WooCommerce plugin (woo-wallet) versions up to and including 1.6.4
WordPress sites running WooCommerce with the vulnerable plugin activated
All user roles from Subscriber upward can trigger the flaw

Discovery Timeline

2026-07-11 - CVE-2026-12103 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-12103

Vulnerability Analysis

The vulnerability resides in the plugin's AJAX handler responsible for user search functionality, referenced at class-woo-wallet-ajax.php around line 166 in versions 1.6.0 through 1.6.3. The handler validates the nonce token but does not verify that the caller holds a capability appropriate for querying the WordPress user directory. Because the plugin treats a valid nonce as sufficient proof of authorization, any logged-in user who can obtain that nonce can invoke the handler.

The search-user nonce is placed into the wallet_param JavaScript object rendered on the WooCommerce My Account page, which every authenticated role can access. A Subscriber can read the nonce from page source and submit arbitrary search strings to the AJAX endpoint, receiving matching accounts with sensitive fields exposed. The exposed data includes login names, email addresses, and numeric user IDs, all of which are useful inputs for follow-on attacks against administrator accounts.

Root Cause

The root cause is a missing capability check ([CWE-862]) in the AJAX action callback. The developer relied on nonce verification alone, conflating request authenticity with request authorization. Nonces prevent cross-site request forgery but do not restrict which roles may call a handler.

Attack Vector

An authenticated Subscriber logs in and visits the WooCommerce My Account page. The attacker extracts the search-user nonce from the localized wallet_param object in page HTML or JavaScript. They then send a crafted admin-ajax.php POST request containing the nonce and an arbitrary search term. The server responds with matching user records, allowing iterative enumeration of the entire user base.

See the Wordfence Vulnerability Analysis and the WordPress Woo Wallet AJAX Code Reference for the vulnerable code path.

Detection Methods for CVE-2026-12103

Indicators of Compromise

Repeated POST requests to /wp-admin/admin-ajax.php with the action parameter targeting the wallet user-search handler from low-privilege session cookies
Bursts of AJAX responses returning multiple user records containing user_login, user_email, and ID fields
Subscriber accounts loading the WooCommerce My Account page followed by high-volume AJAX traffic within the same session
Outbound phishing or credential-stuffing activity targeting administrator email addresses previously exposed on the site

Detection Strategies

Enable verbose logging on admin-ajax.php and alert on non-administrative sessions issuing user-search actions
Correlate WordPress authentication logs with AJAX request volume per session to identify enumeration patterns
Review WooCommerce plugin version inventory across WordPress hosts and flag installations at 1.6.4 or earlier

Monitoring Recommendations

Ingest WordPress and web server access logs into a centralized SIEM for role-aware AJAX request analytics
Baseline expected AJAX call rates for Subscriber-role sessions and alert on statistical deviations
Monitor administrator inboxes for spikes in targeted phishing consistent with harvested addresses

How to Mitigate CVE-2026-12103

Immediate Actions Required

Update the Wallet for WooCommerce plugin to a version later than 1.6.4 that includes the fix committed in Woo Wallet changeset 3585829
Audit WordPress user accounts and disable or restrict Subscriber registrations if not required for business operations
Rotate administrator email addresses or enforce multi-factor authentication on all privileged accounts to blunt downstream credential attacks
Review web server logs for prior enumeration attempts against the wallet AJAX endpoint

Patch Information

The vendor addressed the issue in the release following 1.6.4. The fix adds a capability check to the AJAX handler in addition to the existing nonce verification. Refer to the WordPress Woo Wallet Changeset for the specific code changes.

Workarounds

Deactivate the Wallet for WooCommerce plugin until it can be upgraded on hosts that cannot patch immediately
Deploy a web application firewall rule that blocks admin-ajax.php requests carrying the wallet user-search action when the requesting session is not an administrator
Restrict access to the WooCommerce My Account page from unauthenticated or newly registered accounts through role-based access control plugins

bash

# Example WordPress CLI workflow to inventory and update the plugin
wp plugin get woo-wallet --field=version
wp plugin update woo-wallet
wp plugin deactivate woo-wallet   # if a patched version is not yet available