The Wallet System for WooCommerce plugin, before version 2.8.0, lacks a check to verify that the wallet account named in a withdrawal request belongs to the user making the request. This allows any authenticated user, such as a subscriber or other non‑admin role, to submit a withdrawal on behalf of another user, specifying arbitrary payout amounts and destinations, and to block the victim from making legitimate withdrawals.

The vulnerability affects the Wallet System for WooCommerce WordPress plugin versions 2.0.0 through 2.7.10. Users employing any of these versions are at risk if the plugin is active.

Because the flaw only requires a logged‑in user, it can be exploited by any authenticated member of the site. The CVSS score of 6.3 indicates a moderate severity, but the ability to drain funds and deny service to other users signifies a high-risk impact. The EPSS score of 0.00132 (≈0.13%) indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web‑based request that manipulates the wallet ID field, making the IDOR straightforward to execute from the victim’s own account.