CVE-2026-94245

The Wallet System for WooCommerce WordPress plugin (versions before 2.8.0 ) contains an authorization bypass vulnerability. The plugin fails to verify if the user submitting a wallet transfer actually owns the wallet being debited. This allows any authenticated user, including those with only the...

EUVD-2026-94750

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...

CVE-2026-94244 Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...

CVE-2026-94245 Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an...

WordPress Wallet System for WooCommerce plugin < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure vulnerability

Subscriber+ Store-Wide Wallet Transaction Disclosure vulnerability discovered by Sanyam Jain, Astra Security in WordPress Plugin Wallet System for WooCommerce versions 2.8.0...

CVE-2025-29009-POC

CVE-2025-29009-POC Plugin de Adjunto de Recetas Médicas para WooCommerce = 1.2.3 - Carga Arbitraria de Archivos No Autenticada. Mira la demostración aquí: https://youtu.be/WvW2shDBIFs...

PT-2026-107848

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount a...

PT-2026-107846

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...

PT-2026-107847

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an...

PT-2026-107850

The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's ema...

CVE-2024-43917

CVE-2024-43917 This script demonstrates an SQL injection vulnerability found in the TI WooCommerce Wishlist plugin for WordPress, versions up to 2.8.2 CVE-2024-43917. The vulnerability allows unauthenticated users to execute arbitrary SQL commands on the website’s database, potentially exposing...

WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by John Ryan Albon in WordPress Plugin Food Menu – Restaurant Menu & Online Ordering for WooCommerce versions = 6.0.5...

WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability

WordPress Payever - WooCommerce Gateway plugin = 4.8.2 - PHP Object Injection vulnerability discovered by Lee chul woong in WordPress Plugin Payever - WooCommerce Gateway versions = 4.8.2...

CVE-2026-42714

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Piggly Dev Pix por Piggly para Woocommerce pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly para Woocommerce: from n/a through 2.1.2...

WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Product Configurator for WooCommerce versions = 1.7.5...

CVE-2026-42714

The Piggly Dev Pix por Piggly (para Woocommerce) plugin for WordPress is vulnerable to Blind SQL Injection in versions up to and including 2.1.2 . This vulnerability, categorized as CWE-89 , stems from the improper neutralization of special elements used in SQL commands. The impact includes high ...

CVE-2026-42714 WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Piggly Dev Pix por Piggly para Woocommerce pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly para Woocommerce: from n/a through 2.1.2...

CVE-2026-42714 WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Piggly Dev Pix por Piggly para Woocommerce pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly para Woocommerce: from n/a through 2.1.2...

EUVD-2026-94286

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Piggly Dev Pix por Piggly para Woocommerce pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly para Woocommerce: from n/a through 2.1.2...

WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pix por Piggly para Woocommerce versions = 2.1.2...