CVE-2026-16538: Wallet for WooCommerce Auth Bypass Flaw

CVE-2026-16538 Overview

CVE-2026-16538 affects the Wallet for WooCommerce WordPress plugin in versions prior to 1.6.10. The plugin credits wallet balances without verifying the amount actually collected during a top-up transaction. Customers can manipulate the top-up process to credit their wallet with more value than they paid. The flaw is a business logic error classified under [CWE-284: Improper Access Control].

Critical Impact
Attackers with a standard customer account can inflate their WooCommerce wallet balance by paying less than the credited amount, leading to direct financial loss for merchants running the affected plugin.

Affected Products

Wallet for WooCommerce WordPress plugin versions before 1.6.10
WooCommerce stores using the plugin for stored-value payments
WordPress sites accepting customer wallet top-ups through the plugin

Discovery Timeline

2026-08-12 - CVE-2026-16538 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-16538

Vulnerability Analysis

The vulnerability is a business logic error in the wallet top-up workflow. When a customer initiates a top-up, the plugin credits the requested amount to the wallet balance without confirming that the payment gateway actually collected the corresponding funds. The trust boundary between the requested top-up value and the confirmed payment amount is missing.

This category of flaw sits outside typical injection or memory safety issues. It exists because the payment reconciliation step is skipped or improperly implemented. The attacker does not need elevated privileges, custom tooling, or specialized knowledge of the WordPress internals. A standard customer account and the ability to interact with the checkout flow are sufficient.

The impact is direct financial fraud. Merchants credit wallet balances that customers can then spend on real products, effectively converting a partial or manipulated payment into full-value store credit.

Root Cause

The root cause is the absence of server-side verification comparing the top-up request amount against the confirmed payment amount reported by the payment gateway. The plugin treats the requested top-up as authoritative and credits the wallet regardless of the actual funds received.

Attack Vector

Exploitation occurs over the network through the standard WooCommerce checkout flow. An authenticated customer initiates a wallet top-up, then manipulates the payment amount collected by the gateway while allowing the plugin to credit the originally requested value. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-16538

Indicators of Compromise

Wallet balance credits that do not match corresponding payment gateway settlement records
Unusually low payment amounts followed by high-value wallet-funded purchases from the same account
Repeated wallet top-up transactions from the same customer over short time windows

Detection Strategies

Reconcile WooCommerce order totals for wallet top-up product types against payment gateway settlement reports on a scheduled basis
Alert on any wallet credit whose associated order status is not completed or where the captured amount is less than the credited amount
Review plugin version inventory across WordPress installations and flag any Wallet for WooCommerce instance below 1.6.10

Monitoring Recommendations

Enable verbose logging on the payment gateway and correlate transaction IDs with WooCommerce order metadata
Monitor the wp_usermeta table for rapid or anomalous changes to wallet balance fields
Track customer accounts whose spending is funded primarily by wallet balance rather than direct payments

How to Mitigate CVE-2026-16538

Immediate Actions Required

Update the Wallet for WooCommerce plugin to version 1.6.10 or later on all WordPress installations
Audit wallet top-up history to identify credits that exceed the corresponding captured payment amount
Disable wallet top-ups temporarily if the plugin cannot be updated immediately

Patch Information

The vendor addressed the issue in Wallet for WooCommerce version 1.6.10 by adding verification of the amount actually collected before crediting the wallet. Administrators should apply the update through the WordPress plugin manager or download the fixed release. Refer to the WPScan Vulnerability Report for release details.

Workarounds

Deactivate the Wallet for WooCommerce plugin until the update to 1.6.10 can be applied
Restrict wallet top-up functionality to trusted customer roles using WooCommerce role management
Manually reconcile wallet credits with payment gateway confirmations before allowing wallet-funded checkouts

bash

# Verify installed plugin version using WP-CLI
wp plugin get woo-wallet --field=version

# Update the plugin to the patched release
wp plugin update woo-wallet --version=1.6.10