CVE-2026-15045
MediumCVSS 6.5Summary
The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.
Risk Assessment
The risk includes financial losses, as customers can reduce order totals to zero, leading to revenue loss.
Recommendation
It is recommended to immediately update the plugin to version 2.7.10 or later and implement server-side wallet balance verification.
Original NVD description (English source)
The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.