All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-15045
MEDIUMpublished 2026-08-12 12:17 UTC · 15 hours ago · modified 2026-08-12 13:17 UTC
6.5
CVSS / 10
// description
The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.
// weaknesses (CWE)
- CWE-472