Login Request a demo
Medium severity · published Aug 12, 2026
CVE-2026-15045
Wallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
Wallet System for WooCommerce ·
before 2.7.10 · source: vendor
Affected product
WS
Wallet System for WooCommerce
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15045
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15045
wpscan.com
https://wpscan.com/vulnerability/fc818fa4-5daa-430f-82da-0c96ec531ca3/
More from Wallet System for WooCommerce
6.5
CVE-2026-93509
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount
6.5
CVE-2026-94245
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR
6.3
CVE-2026-94246
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR
4.3
CVE-2026-108763
Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR
4.3
CVE-2026-94244
Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export