A flaw in the Wallet System for WooCommerce’s KYC document submission endpoint allows an authenticated user to supply a target user ID in the request, bypassing any ownership or capability checks. As a result, even low‑privileged accounts such as Subscribers or Customers can submit and overwrite the KYC documents and verification status of any other user, including administrators. This capability effectively lets an attacker impersonate a verified user or revoke another user’s verified status, undermining data integrity and potentially violating compliance requirements.

The vulnerability affects the WordPress plugin Wallet System for WooCommerce on all installations running a version earlier than 2.8.2. The plugin is distributed by an unknown vendor, and any WordPress site that has retained a vulnerable version of the plugin is exposed.

Although the EPSS score is not available and the issue is not listed in CISA’s KEV catalog, the nature of an IDOR means the practical exploitation probability is high. The attack requires only a standard authenticated session with minimal privileges and a straightforward request to a known endpoint. If exploited, attacker‑controlled KYC data could misrepresent user identities, potentially causing financial or regulatory harm. The impact therefore is substantial, with a high severity expectation based on the vulnerability’s characteristics.