CVE-2026-15045CWE-472

CVE-2026-15045

Medium · published August 12, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
25.7
In the wild
Unconfirmed
What it is

The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00336 · 25.7th percentile
Weakness
CWE-472 · External Control of Assumed-Immutable Web Parameter
Published
2026-08-12T16:17Z
References (1)
https://wpscan.com/vulnerability/fc818fa4-5daa-430f-82da-0c96ec531ca3/ · [email protected]
EPSS history
Timeline
  • 12 AUG 11:23Z
    Wallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount
    cvelistv5