High severity · published Jun 2, 2026
CVE-2026-42654
WordPress Wallet System for WooCommerce plugin <= 2.7.5 - Broken Authentication vulnerability
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Swings Wallet System for WooCommerce allows Password Recovery Exploitation.
This issue affects Wallet System for WooCommerce: from n/a through 2.7.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
Wallet System for WooCommerce · WP Swings
through 2.7.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42654
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42654
patchstack.com
https://patchstack.com/database/wordpress/plugin/wallet-system-for-woocommerce/vulnerability/wordpress-wallet-system-for-woocommerce-plugin-2-7-5-broken-authentication-vulnerability?_s_id=cve
More from Wallet System for WooCommerce
7.1
CVE-2026-57332
WordPress Wallet System for WooCommerce plugin <= 2.7.6 - Broken Access Control vulnerability
6.3
CVE-2025-68029
WordPress Wallet System for WooCommerce plugin <= 2.7.3 - Sensitive Data Exposure vulnerability