The Wallet System for WooCommerce plugin before 2.8.0 does not enforce that a transfer amount is positive. An authenticated user with Subscriber‑level privileges can submit a negative value, causing the system to compute the sender’s new balance from a stale snapshot taken before crediting the recipient. This flaw allows the attacker to mint additional funds for themselves or to drain a victim’s wallet balance into their own account, thereby compromising the integrity of wallet balances. The weakness stems from improper input validation (CWE‑20). The impact is non‑remote code execution but results in financial manipulation within the platform.

WordPress installations using the Wallet System for WooCommerce plugin versions 2.0.0 through 2.7.10 are affected. Any site that has not upgraded to 2.8.0 or later remains vulnerable. No other product versions are listed as affected.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation is unclear but potentially high given the attacker only needs Subscriber‑level access. The vulnerability is not listed in CISA KEV, but its existence is publicly documented. The likely attack vector is authenticated exploitation within the WooCommerce environment, where an attacker manipulates the transfer amount to affect wallet balances. The lack of validation and the use of a stale snapshot provide a straightforward path for an attacker to inflate or reduce balances at will.