CVE-2026-15045: WooCommerce Wallet Auth Bypass Vulnerability

CVE-2026-15045 Overview

CVE-2026-15045 is a business logic flaw in the Wallet System for WooCommerce WordPress plugin versions before 2.7.10. The plugin fails to validate the wallet amount submitted during checkout against the customer's actual stored balance. Authenticated customers can submit an arbitrary wallet deduction value, reducing their order total to any amount, including zero. Attackers can complete purchases without transferring funds to the merchant. The issue is classified under [CWE-472: External Control of Assumed-Immutable Web Parameter].

Critical Impact
Any authenticated customer can complete WooCommerce orders without paying, resulting in direct financial loss to merchants running the vulnerable plugin.

Affected Products

Wallet System for WooCommerce WordPress plugin versions prior to 2.7.10
WordPress sites running WooCommerce with the vulnerable plugin enabled
Merchants accepting wallet-based checkout on affected installations

Discovery Timeline

2026-08-12 - CVE-2026-15045 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-15045

Vulnerability Analysis

The Wallet System for WooCommerce plugin allows customers to pay for orders using a stored wallet balance. During checkout, the plugin accepts a user-supplied parameter indicating the wallet amount to apply to the order. The plugin does not compare this value to the customer's actual stored wallet balance on the server side. As a result, the client-controlled value is treated as authoritative and used directly to reduce the order total.

An authenticated customer can manipulate the wallet parameter to submit any value, including one that exceeds their actual balance or matches the full order total. The checkout process completes successfully, and the order is marked as paid without funds being deducted from a valid balance or transferred to the merchant.

Root Cause

The root cause is missing server-side validation of a security-critical request parameter. The plugin assumes the wallet amount transmitted from the checkout form is immutable or trustworthy. [CWE-472] describes this class of flaw, where an assumed-immutable web parameter is externally controllable. No comparison is performed between the submitted deduction and the authenticated user's stored balance in the database.

Attack Vector

Exploitation requires an authenticated customer account on the target WooCommerce store. The attacker intercepts the checkout request using a proxy such as Burp Suite or crafts a direct HTTP POST to the checkout endpoint. The wallet amount field in the request body is modified to equal the order total, reducing the amount due to zero. The order is then submitted through the normal checkout flow and completed without payment. Refer to the WPScan Vulnerability Advisory for advisory details.

Detection Methods for CVE-2026-15045

Indicators of Compromise

WooCommerce orders with a status of completed or processing but a final total of zero or unexpectedly low value.
Wallet transaction logs showing deductions that exceed the customer's prior recorded balance.
Multiple orders from the same authenticated customer in a short window with anomalous wallet applications.

Detection Strategies

Reconcile WooCommerce order totals against payment gateway transaction records to identify orders completed without matching payment.
Audit the wp_wc_wallet_transactions table (or plugin equivalent) for negative balances or deductions greater than recorded credits.
Review web server access logs for POST requests to the checkout endpoint containing manipulated wallet parameters.

Monitoring Recommendations

Enable WooCommerce order logging and forward events to a centralized SIEM for correlation with payment processor data.
Alert on any order completion where the applied wallet amount exceeds the customer's known ledger balance.
Monitor plugin file integrity and version metadata to confirm patched versions remain in place after updates.

How to Mitigate CVE-2026-15045

Immediate Actions Required

Update the Wallet System for WooCommerce plugin to version 2.7.10 or later immediately.
Audit recent orders for zero-total or under-paid completions and reverse fraudulent transactions.
Temporarily disable wallet-based checkout if the plugin cannot be updated right away.

Patch Information

The vendor addressed the flaw in Wallet System for WooCommerce version 2.7.10 by adding server-side validation of the submitted wallet amount against the customer's stored balance. Site administrators should upgrade through the WordPress plugin dashboard or by replacing the plugin files with the patched release. See the WPScan Vulnerability Advisory for the authoritative fix reference.

Workarounds

Disable the Wallet System for WooCommerce plugin until the update is applied.
Restrict new customer registration to reduce the population of accounts that can abuse the flaw.
Add a web application firewall rule to inspect checkout requests and block those containing wallet parameters exceeding a defined threshold.

bash

# Update the plugin via WP-CLI on the WordPress host
wp plugin update woo-wallet --version=2.7.10

# Verify the installed version after upgrade
wp plugin get woo-wallet --field=version