CVE-2026-94244: WooCommerce Wallet System Information Disclosure

CVE-2026-94244 is an information disclosure vulnerability in the Wallet System for WooCommerce WordPress plugin. It allows any authenticated user to access sensitive customer data including wallet transactions and personal information. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-94244 Overview

CVE-2026-94244 affects the Wallet System for WooCommerce WordPress plugin in versions prior to 2.8.0. The plugin fails to perform capability checks before generating a report containing every customer's wallet transaction history. Any authenticated user, including subscriber-level accounts, can obtain a token from a front-end page and request the report. The exposed data includes customer names, email addresses, user roles, transaction amounts, payment methods, and transaction dates. The flaw is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Low-privilege authenticated users can exfiltrate the full customer wallet transaction history, including personally identifiable information (PII) and financial activity, from affected WooCommerce stores.

Affected Products

Wallet System for WooCommerce WordPress plugin versions before 2.8.0
WordPress sites running WooCommerce with the vulnerable plugin installed
Any site permitting self-service user registration (subscriber accounts) with the plugin enabled

Discovery Timeline

2026-10-08 - CVE-2026-94244 published to NVD
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-94244

Vulnerability Analysis

The vulnerability resides in the plugin's wallet transaction report generation workflow. The plugin exposes a report endpoint intended for administrators but does not call WordPress capability functions such as current_user_can() before producing output. Access control relies solely on possession of a token.

That token is retrievable from a front-end page accessible to any logged-in user. A subscriber can obtain the token and submit it to the report endpoint. The endpoint then returns the full transaction dataset for all customers, bypassing the intended administrator-only boundary.

The disclosed records combine identity data (names, email addresses, roles) with financial data (amounts, payment methods, dates). Attackers can leverage this dataset for targeted phishing, credential-stuffing enrichment, or fraud reconnaissance against the store's customer base.

Root Cause

The root cause is a missing authorization check [CWE-200, CWE-862]. The plugin treats a front-end-obtainable token as a sufficient authorization artifact and omits a role or capability verification against the requesting user. Token possession is conflated with permission to view administrative data.

Attack Vector

Exploitation requires network access to the target WordPress site and a valid authenticated session at any privilege level. An attacker registers (or uses an existing subscriber account), browses to the front-end page that issues the token, captures the token value, and submits a request to the vulnerable report endpoint. The response discloses the complete wallet transaction history for every customer. No user interaction from an administrator is required.

See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-94244

Indicators of Compromise

Requests to the plugin's wallet report endpoint originating from accounts with the subscriber or customer role
Unusually large HTTP responses from the plugin containing CSV, JSON, or tabular transaction data served to non-administrator sessions
Repeated front-end token-fetch requests from the same low-privilege account followed by report endpoint calls

Detection Strategies

Review WordPress and web server access logs for report endpoint URIs correlated with low-privilege session cookies
Inspect WooCommerce audit logs for report generation events attributed to non-administrator users
Deploy a Web Application Firewall (WAF) rule that denies access to the report endpoint when the request lacks an administrator capability

Monitoring Recommendations

Monitor spikes in new subscriber account registrations followed by immediate access to plugin endpoints
Alert on outbound responses from /wp-admin/admin-ajax.php or plugin-specific URIs exceeding a baseline size
Track plugin version inventory across managed WordPress installations and flag any instance running a version earlier than 2.8.0

How to Mitigate CVE-2026-94244

Immediate Actions Required

Upgrade the Wallet System for WooCommerce plugin to version 2.8.0 or later on all affected sites
Audit existing subscriber and customer accounts for suspicious registrations and recent plugin endpoint activity
Rotate any API tokens or secrets stored alongside the exposed transaction data and notify affected customers if disclosure is confirmed

Patch Information

The vendor addressed the issue in Wallet System for WooCommerce version 2.8.0 by adding a capability check to the report generation workflow. Administrators should update through the WordPress plugin dashboard or via WP-CLI with wp plugin update woo-wallet. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily disable the Wallet System for WooCommerce plugin until the upgrade is applied
Restrict new user registrations or require manual administrator approval for subscriber accounts
Block the vulnerable report endpoint at the WAF or reverse proxy for all requests not originating from administrator sessions

bash

# Update the plugin via WP-CLI
wp plugin update woo-wallet --version=2.8.0

# Verify the installed version
wp plugin get woo-wallet --field=version

# Temporary mitigation: disable the plugin until patched
wp plugin deactivate woo-wallet