The WordPress Wallet System for WooCommerce plugin contains a Cross‑Site Request Forgery vulnerability that allows a malicious actor to cause an authenticated user to execute plugin actions without the user’s consent, because the plugin does not verify the origin of requests. This flaw is present in all releases up to and including version 2.6.7, as stated by the vendor (inferred).

Any WordPress site that has installed the WP Swings Wallet System for WooCommerce plugin version 2.6.7 or earlier is affected. The vulnerability does not depend on other factors such as site configuration beyond the plugin version.

The CVSS score of 4.3 indicates moderate severity. EPSS is listed as less than 1%, implying a low short‑term likelihood of exploitation. The vulnerability is not present in the CISA KEV catalog. The likely attack vector is a CSRF scenario in which an attacker lures a logged‑in user to a malicious site that submits a crafted request to the vulnerable endpoint. Because the flaw requires a victim to be authenticated (inferred) and the exploitation probability is low, the overall risk remains moderate but should be addressed before a patch becomes available.