{"id":"CVE-2026-93509","published":"2026-10-08T11:16:47.217","lastModified":"2026-10-08T20:51:18.123","description":"The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-20"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/a31138af-234e-44c8-bced-9058553a8b81/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}