The vulnerability in WP Swings Wallet System for WooCommerce allows an attacker to bypass authentication by exploiting an alternate path or channel used during password recovery. Because of this flaw an unauthenticated attacker could trigger the password reset process and potentially reset a user's credentials, thereby gaining unauthorized access to the website and its e‑commerce functionalities. The weakness is a classic authentication bypass, classified as CWE-288.

Affected products are WP Swings Wallet System for WooCommerce plugins through version 2.7.5. Any installation of this plugin that has not upgraded to the fixed release is vulnerable.

The CVSS score of 7.1 indicates moderate to high severity. No EPSS score is published, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploit in the wild. The flaw permits an unauthenticated attacker to access the password recovery endpoint, which is typically publicly reachable, potentially resetting a user’s credentials and gaining unauthorized access. Because the exploitation path is straightforward and widely reachable, the risk to affected installations is significant, though no public exploit evidence exists.