{"id":49354,"date":"2026-10-15T16:45:16","date_gmt":"2026-10-15T11:15:16","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/?p=49354"},"modified":"2026-10-21T15:16:08","modified_gmt":"2026-10-21T09:46:08","slug":"cve-2026-94244","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/vulnerability\/cve-2026-94244\/","title":{"rendered":"CVE-2026-94244: Missing Authorization in Wallet System for WooCommerce"},"content":{"rendered":"
\n\n

Product Name:<\/strong> Wallet System in WooCommerce<\/p>\n\n\n\n

Vulnerability:<\/strong> Missing Authorization Leading to Store-Wide Customer Data Exposure via Exported Wallet Transaction File

Vulnerable Version:<\/strong> < 2.8.0

Patched Version:<\/strong> 2.8.0

CVE:<\/strong> CVE-2026-94244

CVSS:<\/strong> 4.3 (Medium)  AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N

CWE:<\/strong> CWE-862 (Missing Authorization) \u2192 CWE-200 (Sensitive Information Disclosure)<\/p>\n\n<\/div>\n\n\n

<\/p>\n\n\n\n

On 02\/09\/2026, a security researcher at Astra Security found a Missing Authorization vulnerability in Wallet System for WooCommerce<\/a>, a popular WordPress plugin by WP Swings that adds wallet-based payments to WooCommerce stores.<\/p>\n\n\n\n

The root cause is a Missing Authorization vulnerability (CWE-862) leading to Sensitive Information Disclosure via Exported File (CWE-200) in the plugin\u2019s administrative wallet-transaction export feature. The feature itself is a legitimate bookkeeping tool, letting store administrators export every customer\u2019s wallet-transaction history as a PDF or CSV file. The problem is who\u2019s allowed to trigger it.<\/p>\n\n\n\n

In its current form, any authenticated user with Subscriber-level access or higher can POST a nonce sourced from an unrelated feature to any \/wp-admin\/*.php <\/code>URL and receive back a full database dump of every customer\u2019s wallet transactions and PII. On a WooCommerce store, this includes every Customer-tier account.<\/p>\n\n\n\n

The flaw sits in the export handler\u2019s registration and authorization logic within admin\/class-wallet-system-for-woocommerce-admin.php<\/code>, specifically in wps_wsfw_download_pdf_file_callback()<\/code>.<\/p>\n\n\n\n

<\/span>Technical Breakdown of CVE-2026-94244<\/span><\/h2>\n\n\n\n

CVE-2026-94244<\/strong> was discovered during a manual security review of the plugin\u2019s administrative export functionality and global hook registrations. The vulnerability is a textbook combination of two WordPress-specific missteps compounded in one function.<\/p>\n\n\n\n

The export handler is registered on WordPress\u2019s global init hook and gated by nothing more than an is_admin() wrapper<\/code>, which checks only whether the request URL falls under \/wp-admin\/<\/code>, not whether the requester holds any actual permission to be there. <\/p>\n\n\n\n

The handler itself performs no login check and no capability check. Its single real gate is a wp_verify_nonce()<\/code> call invoked with no action argument, which WordPress silently defaults to the catch-all generic nonce action, meaning any default-action nonce already minted anywhere else on the site for the same logged-in user will satisfy it.<\/p>\n\n\n\n

<\/span>How was CVE-2026-94244 discovered?<\/span><\/h2>\n\n\n\n
\"CVE-2026-94244\"<\/figure>\n\n\n\n

While reviewing the plugin\u2019s admin hook registrations in includes\/class-wallet-system-for-woocommerce.php<\/code>, our researcher noticed the export function hooked directly onto WordPress\u2019s global init action, with no capability check and only a generic nonce as a gate:<\/p>\n\n\n\n

php\n\n$this->loader->add_action(\n\n    'init',\n\n    $wsfw_plugin_admin,\n\n    'wps_wsfw_download_pdf_file_callback'\n\n);<\/code><\/pre>\n\n\n\n
Pulling the handler itself (admin\/class-wallet-system-for-woocommerce-admin.php)<\/code>, the researcher found a single wp_verify_nonce() <\/code>call standing between any authenticated user and a store-wide database export:<\/p>\n\n\n\n
php\n\npublic function wps_wsfw_download_pdf_file_callback() {\n\n    $nonce = ( isset( $_POST['updatenoncewallet_pdf_dwnload'] ) )\n\n        ? sanitize_text_field( wp_unslash( $_POST['updatenoncewallet_pdf_dwnload'] ) )\n\n        : '';\n\n    if ( wp_verify_nonce( $nonce ) ) {\n\n        \/\/ ^-- THE ENTIRE GATE. No login check. No capability check. Default action (-1).\n\n        if ( isset( $_POST['wps_wsfw_export_pdf'] ) ) {\n\n            global $wpdb;\n\n            $transactions = $wpdb->get_results(\n\n                'SELECT * FROM ' . $wpdb->prefix . 'wps_wsfw_wallet_transaction ORDER BY Id DESC'\n\n            );\n\n            \/\/ ^-- every row, every user, no WHERE clause\n\n        }\n\n    }\n\n}<\/code><\/pre>\n\n\n\n
Two things stood out immediately. First, the SQL query carried no WHERE user_id = \u2026 clause<\/code>, so the export dumped the entire transactions table regardless of who requested it. Second, with the nonce check defaulting to the generic action, any nonce the attacker could get WordPress to mint for their own session would unlock the export.<\/p>\n\n\n\n
To confirm the vulnerability was exploitable from a low-privileged account, the researcher logged in as a plain Customer and loaded the plugin\u2019s own front-end \u201cMy Account \u2192 Wallet\u201d page. That page unconditionally renders a second hidden form field carrying a bare default-action nonce for a completely unrelated feature:<\/p>\n\n\n\n
php\n\n<input type=\"hidden\" id=\"wps_verifynonce\" name=\"wps_verifynonce\"\n\n       value=\"<?php echo esc_attr( wp_create_nonce() ); ?>\" \/>\n<\/code><\/pre>\n\n\n\n
Taking that nonce and replaying it against \/wp-admin\/admin.php with wps_wsfw_export_pdf=1 returned a genuine PDF containing another user\u2019s seeded wallet transactions. This confirmed the Missing Authorization vulnerability (CWE-862), leading to the responsible disclosure and this advisory.<\/p>\n\n\n\n
<\/span>How to replicate the vulnerability CVE-2026-94244<\/span><\/h2>\n\n\n\n
Prerequisites<\/h3>\n\n\n\n