CVE-2026-42654: Wallet System for WooCommerce Auth Bypass

CVE-2026-42654 Overview

CVE-2026-42654 is an authentication bypass vulnerability in the WP Swings Wallet System for WooCommerce plugin. The flaw resides in the plugin's password recovery workflow, which exposes an alternate authentication channel that attackers can abuse. The vulnerability affects all versions of Wallet System for WooCommerce up to and including 2.7.5.

An authenticated attacker with low privileges can exploit the password recovery functionality to take over other accounts on the WooCommerce store. Successful exploitation compromises account integrity and grants access to wallet balances, customer data, and store functions tied to the targeted accounts. The vulnerability is categorized under [CWE-288: Authentication Bypass Using an Alternate Path or Channel].

Critical Impact
Attackers holding a low-privilege account can bypass authentication via the password recovery flow and hijack other user accounts on affected WooCommerce stores.

Affected Products

WP Swings Wallet System for WooCommerce plugin
All versions from n/a through 2.7.5
WordPress sites running WooCommerce with the affected plugin installed

Discovery Timeline

2026-06-02 - CVE CVE-2026-42654 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-42654

Vulnerability Analysis

The Wallet System for WooCommerce plugin extends WooCommerce stores with a wallet feature for customers. The plugin implements a password recovery workflow that operates as an alternate authentication channel. This channel does not enforce the same verification controls as the primary login path.

The vulnerability is exploitable over the network and requires an authenticated session with low privileges. No user interaction is required from the victim. The attack does not require elevated permissions, which broadens the pool of potential attackers to any user who can register on the store. The primary impact is to account integrity, with secondary exposure of confidential data belonging to compromised accounts.

Root Cause

The root cause is improper validation in the password recovery path. The plugin trusts inputs supplied during the recovery flow without sufficiently binding the request to the legitimate account owner. This permits an attacker to invoke recovery actions against accounts they do not control and to reset credentials on those accounts.

Attack Vector

An attacker first authenticates to the WooCommerce site as a low-privileged user. The attacker then issues crafted requests to the plugin's password recovery endpoint, targeting a victim account. Because the recovery channel does not properly authenticate the requestor against the target account, the attacker can set new credentials and log in as the victim. From there, the attacker can manipulate wallet balances, view stored data, and perform actions permitted to the compromised role.

No verified public proof-of-concept is available at this time. See the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-42654

Indicators of Compromise

Unexpected password reset events for WooCommerce accounts that did not originate from the affected user.
Logins from new IP addresses or geolocations immediately after a password recovery action.
Anomalous wallet balance changes, withdrawals, or transfers following an account password change.
HTTP requests to the Wallet System for WooCommerce password recovery endpoints from accounts that do not own the target user.

Detection Strategies

Audit WordPress and WooCommerce logs for password reset events correlated with the wallet-system-for-woocommerce plugin.
Correlate session activity with password recovery requests to identify requests issued by accounts other than the target user.
Alert on rapid sequences of authentication, password reset, and re-authentication originating from a single source IP.

Monitoring Recommendations

Enable verbose logging for WordPress authentication events including password_reset, user_login, and plugin-specific hooks.
Forward web server access logs and WordPress audit logs to a centralized analytics platform for correlation.
Monitor for HTTP POST requests to plugin endpoints under /wp-admin/admin-ajax.php and /wp-json/ that reference wallet or password reset actions.

How to Mitigate CVE-2026-42654

Immediate Actions Required

Inventory WordPress installations to identify sites running Wallet System for WooCommerce version 2.7.5 or earlier.
Update the plugin to a fixed version once released by WP Swings, or remove the plugin if a patch is not yet available.
Force password resets and session invalidation for all WooCommerce user accounts on affected sites.
Review wallet transaction history for unauthorized balance changes and reverse fraudulent activity.

Patch Information

At the time of publication, the vendor advisory tracked through Patchstack lists versions up to 2.7.5 as vulnerable. Administrators should consult the Patchstack Vulnerability Report and the WP Swings plugin changelog for the fixed release version.

Workarounds

Temporarily deactivate the Wallet System for WooCommerce plugin until a patched version is installed.
Restrict access to WordPress registration and login endpoints using a web application firewall to limit untrusted account creation.
Apply virtual patching rules at the WAF layer to block requests to the plugin's password recovery endpoints from non-owner sessions.
Enforce multi-factor authentication on WooCommerce accounts to limit the impact of credential resets.

bash

# Example: disable the affected plugin via WP-CLI until a patched version is available
wp plugin deactivate wallet-system-for-woocommerce
wp plugin status wallet-system-for-woocommerce