Auth bypass in Wallet System For Woocommerce

CVE-2026-108763

The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.

Vulnerability class: IDOR (Insecure Direct Object Reference)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

EPSS exploit prediction

EPSS: 0.001 (3.5th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 4th percentile — 3.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

  • Wallet System For Woocommerce

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-108763?
CVE-2026-108763 is a medium-severity vulnerability in Wallet System For Woocommerce, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.3/10. Published 2026-10-29.
How severe is CVE-2026-108763?
Medium severity. CVSS v3 base score is 4.3 out of 10.