PT-2026-3339 · Unknown+1 · Woocommerce+1

CVE-2025-14450 · Publicado 2026-01-17 · Atualizado 2026-01-17

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wallet System for WooCommerce plugin for WordPress versions prior to 2.7.3

Description The Wallet System for WooCommerce plugin for WordPress has a flaw that allows unauthorized data modification. This is due to a missing capability check within the change wallet fund request status callback() function. Authenticated attackers possessing Subscriber-level access or higher can manipulate wallet withdrawal requests, potentially increasing their own wallet balance or decreasing the balances of other users.

Recommendations Update the Wallet System for WooCommerce plugin to version 2.7.3 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14450

Produtos afetados

Wallet System For Woocommerce

Woocommerce

Referências · 7

• https://twitter.com/CVEnew/status/2012490357829750844 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/466a5315-fc05-4b96-9dfd-17862fc406c5?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14450 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/wallet-system-for-woocommerce/tags/2.7.2/includes/class-wallet-system-ajaxhandler.php#L140 · Nota
• https://twitter.com/VulmonFeeds/status/2012373927792710138 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/wallet-system-for-woocommerce/trunk/includes/class-wallet-system-ajaxhandler.php#L140 · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3435898%40wallet-system-for-woocommerce&new=3435898%40wallet-system-for-woocommerce&sfp_email=&sfph_mail= · Nota