A broken access control flaw exists in the Wallet System for WooCommerce plugin up to version 2.7.6 that allows a user possessing subscriber privileges to perform actions normally reserved for higher‑level users. This flaw can potentially enable the reader to alter wallet balances, create or delete transactions, and otherwise compromise the integrity of the financial system embedded in a WordPress site. The vulnerability arises from inadequate capability checks in privileged functions, a weakness identified as CWE‑862.

The issue affects the WP Swings: Wallet System for WooCommerce plugin. Any installation running a version prior to 2.7.7 is potentially vulnerable, regardless of other plugin or theme configurations.

The CVSS base score of 7.1 indicates high severity, and while the EPSS score is not available, the lack of a KEV listing suggests that documented exploits are not yet public. Based on the description, an attacker would first authenticate as a subscriber or any user with wallet access, then invoke privileged endpoints that bypass normal capability checks. The impact is primarily integrity and availability of wallet data, and could lead to financial loss or unauthorized funding of transactions.