An authenticated user with at least Subscriber role can alter wallet withdrawal requests by calling the ‘change_wallet_fund_request_status_callback’ endpoint without proper capability checks. This flaw permits the attacker to arbitrarily increase their own wallet balance or debit other users, leading to financial abuse.

Vulnerable versions include all releases of Wallet System for WooCommerce up to and including 2.7.2, which is distributed by wpswings under the nickname ‘Digital Wallet, Buy Now Pay Later, Instant Cashback, Referral program, Partial & Subscription Payments.’ Sites running any of these versions on WordPress are within scope.

CVSS score 6.5 indicates a moderate severity, while EPSS <1% signals low likelihood of public exploitation at this time. The flaw is not listed in CISA KEV, but any authenticated attacker can exploit it by simply performing a suitable AJAX request after login. Successful exploitation results in unauthorized balance manipulation, potentially inflating the attacker's funds or depleting others, damaging customer trust and financial integrity.