Medium severity · published Oct 29, 2026
CVE-2026-108763
Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR
New
4.3
CVSS
–
EPSS
No
On KEV
Description
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
Wallet System for WooCommerce ·
before 2.8.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-108763
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-108763
exploit
https://wpscan.com/vulnerability/78a72702-c7c1-4f9a-a832-339e04011e34/
More from Wallet System for WooCommerce
6.5
CVE-2026-93509
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount
6.5
CVE-2026-94245
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR
6.5
CVE-2026-15045
Wallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount
6.3
CVE-2026-94246
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR
4.3
CVE-2026-94244
Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export