All vulnerabilities
CVE-2026-108763

Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR

Unknown Wallet System for WooCommerce
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2.8.2Fixed versionCVE List
Published29 Oct 2026Updated 29 Oct 2026CVE List

What fixes it

  • 2.8.2Wallet System for WooCommerceCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.

Text from CVE List

Affected versions 1

  • Wallet System for WooCommerceaffected: all versions before 2.8.2CVE List

References 1