PT-2026-3339 · Unknown+1 · Woocommerce+1

Published 2026-01-17 · Updated 2026-01-17 · CVE-2025-14450

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wallet System for WooCommerce plugin for WordPress versions prior to 2.7.3

Description The Wallet System for WooCommerce plugin for WordPress has a flaw that allows unauthorized data modification. This is due to a missing capability check within the change wallet fund request status callback() function. Authenticated attackers possessing Subscriber-level access or higher can manipulate wallet withdrawal requests, potentially increasing their own wallet balance or decreasing the balances of other users.

Recommendations Update the Wallet System for WooCommerce plugin to version 2.7.3 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14450

Affected Products

Wallet System For Woocommerce

Woocommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14450 · Security Note
• https://twitter.com/CVEnew/status/2012490357829750844 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/466a5315-fc05-4b96-9dfd-17862fc406c5?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wallet-system-for-woocommerce/tags/2.7.2/includes/class-wallet-system-ajaxhandler.php#L140 · Note
• https://twitter.com/VulmonFeeds/status/2012373927792710138 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wallet-system-for-woocommerce/trunk/includes/class-wallet-system-ajaxhandler.php#L140 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3435898%40wallet-system-for-woocommerce&new=3435898%40wallet-system-for-woocommerce&sfp_email=&sfph_mail= · Note