The Wallet System for WooCommerce WordPress plugin before version 2.7.10 does not verify that the wallet amount entered at checkout does not exceed the amount actually stored in a customer's account. As a result, an authenticated user can submit an arbitrary wallet balance, causing the order total to drop to any desired value—including zero—and complete the transaction without the merchant receiving payment. This flaw is a CWE‑472 weakness that enables financial fraud by manipulating the transaction amount.

The vulnerable product is the Wallet System for WooCommerce plugin. All releases before 2.7.10 are affected, including every version up to and excluding 2.7.10. The plugin is typically installed on WordPress sites that use WooCommerce as the e‑commerce platform, though the vendor is listed as Unknown.

The issue has a CVSS v3 score of 6.5, indicating moderate severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, so no confirmed exploitation has been reported yet. The attack vector is the standard checkout flow; an authenticated customer must have access to the checkout page and may submit a crafted wallet amount. Because the flaw allows the attacker to reduce revenue to zero, the financial impact can be significant even though the exploit requires no privileged access or additional network vulnerabilities. Prompt remediation is recommended to prevent potential monetary loss.