The vulnerability arises because the plugin fails to verify that the wallet being debited belongs to the authenticated user initiating the transfer. This flaw permits any logged‑in user, even those with only a Subscriber role, to move the balance of any other user—including administrators—into an account they control. The result is that an attacker can steal arbitrary amounts of virtual currency or store credit, leading to significant financial loss and undermining the integrity of the e‑commerce platform.

Any WordPress site running the Wallet System for WooCommerce plugin with a version older than 2.8.0 is impacted. This includes all releases from 2.0.0 up to and including 2.7.10. The plugin provides wallet management functionality for WooCommerce stores.

The CVSS score of 6.5 indicates a medium‑to‑high severity; the EPSS score of < 1% suggests a low probability of widespread exploitation, but the ease of the authorization bypass and the potential for financial loss still warrant serious attention. The vulnerability is not listed in CISA’s KEV catalog.