If you received an email from me pointing you to this page, it is because your website appears to be running a vulnerable version of Wallet System for WooCommerce (the WordPress plugin wallet-system-for-woocommerce, by WP Swings). This page explains why that matters and how to fix it.

This notice concerns CVE-2026-42654, a high-severity flaw (CVSS 7.1) in the plugin’s account and password-recovery flow that could let an unauthorized request gain access to a customer account. It affects every release before 2.7.6 and is fixed in 2.7.6. If you are running an affected version, update Wallet System for WooCommerce to 2.7.6 or later (the latest release, 2.7.8, is recommended).

A word on urgency, because it is different from other notices I have sent: this is an account-access flaw, not a server or full-admin takeover, and there is no indication that it is being exploited. This page is a precautionary heads-up, not an incident report. Updating closes the issue, and no emergency response is implied.

This is a plugin flaw, not a WordPress or WooCommerce core flaw. A fully up-to-date WordPress and WooCommerce do not protect you if the Wallet System for WooCommerce plugin itself is on an affected version.

Is this message legitimate?

Yes. This is a good-faith, responsible-disclosure notice from an independent security researcher. I am not asking you for money, passwords, or access to your site, and I have not attempted to break into it, upload anything, or exploit anything.

All I did was look at publicly visible files that your website serves to every visitor (the same way your homepage is public) and note the version number that the Wallet System for WooCommerce plugin publishes in its public README.txt file. I specifically did not touch the vulnerable endpoint, and nothing about this check touches your data, your admin area, or any private part of your site (more detail under What I did and did not do below).

If you would like to verify who I am, see the contact details at the bottom of this page and the About page.

Why this matters

Wallet System for WooCommerce is a WooCommerce add-on (around 2,000 active installs) that lets a store offer its customers a digital wallet: customers hold a balance, top it up, and pay with it at checkout. In affected versions, privileged wallet actions in the plugin’s account and password-recovery flow were protected by a shared security token that the plugin handed out to every visitor, instead of a real permission check tied to who is making the request. This class of mistake is called authentication bypass using an alternate path or channel (CWE-288): the normal login path checks identity properly, but a side path accepts the shared token as if it proved authorization.

The practical effect is that a request arriving on that side path, which is reachable by any registered customer (and a store running a customer wallet almost always allows open registration), could act as an authorized user and gain access to a customer account.

The flaw was scored 7.1 out of 10 (high severity). To keep that in perspective: it is an account-access issue, it does not by itself hand an attacker your server or an administrator account, and there is no indication of active exploitation (it is not in CISA’s Known Exploited Vulnerabilities catalog, and I am aware of no exploitation reports). If my email cited this issue, it means the version your site reports falls within the affected range. I did not test whether your particular site is exploitable, only that it reports an affected version.

The good news: updating to the fixed version closes the issue, and the update is straightforward.

How to check your version

You do not have to take my word for which version you are running.

From the public manifest (no login needed): open yourdomain.com/wp-content/plugins/wallet-system-for-woocommerce/README.txt in a browser. Note that this plugin ships its readme as README.txt (uppercase), unlike many plugins that use a lowercase readme.txt. The Stable tag: line near the top is the version your install reports, and this is the same public file I read.

From the WordPress admin area (if you have access):

  1. Log in to your WordPress dashboard (usually at yourdomain.com/wp-admin).
  2. Go to Plugins then Installed Plugins.
  3. Find Wallet System for WooCommerce and note the version shown beneath its name.

Then apply this rule, and note that versions compare numerically, not alphabetically:

  • Any version below 2.7.6: affected, update now. Every earlier release carries the flaw; there is no safe older version.
  • 2.7.6 or newer, including 2.7.7 and 2.7.8: already fixed.
  • Do not be misled by text ordering: 2.5.11 is a later release than 2.5.9, because 11 is greater than 9. Compare each number in turn rather than reading the version as text (both of those examples are below 2.7.6 and therefore affected; the point is how to read version numbers in general).

How to upgrade

The safest path is to update through WordPress itself, and to back up first:

  1. Back up your site (files and database) before making changes. Most hosting providers offer one-click backups, or use a WordPress backup plugin.
  2. In the WordPress admin, go to Dashboard then Updates, or Plugins then Installed Plugins. If a Wallet System for WooCommerce update is listed, install it from here.
  3. If you prefer the command line, WP-CLI does the same thing: wp plugin update wallet-system-for-woocommerce.
  4. If no update appears, you can get the latest release directly from the plugin’s page on the WordPress.org directory, Wallet System for WooCommerce, and update via Plugins then Add New Plugin then Upload Plugin.
  5. After updating, confirm the new version number (2.7.6 or later; the latest 2.7.8 is recommended) using the steps above, and check that your store and its wallet features work normally.

While you are in there, it is worth confirming that WordPress core, WooCommerce, and your other plugins are up to date, since the same principle applies to all of them.

After updating

Updating to 2.7.6 or later closes the issue, and for most stores that is the whole task. There is no indication this flaw has been exploited, so no emergency response is implied: you do not need to treat your site as compromised, take it offline, or force password resets.

Because the flaw could let an unauthorized request act on a customer account, one routine follow-up is sensible: have a look over recent account and wallet activity for anything unfamiliar, for example wallet balance adjustments you did not make, withdrawal or fund requests you do not recognize, or customer-account changes your customers did not request. Treat this as ordinary housekeeping of the kind a store does periodically, not as incident response. If something does look wrong, the usual steps apply (reset that customer’s password and review the activity with them), and you are welcome to contact me with questions.

What I did and did not do

To be fully transparent about the check behind my email: I only read public files that your site already serves to every visitor, specifically the plugin’s public README.txt file and your homepage. I did not access your WordPress admin area, your database, or any private part of the site. In particular, I did not touch the vulnerable endpoint, and I did not test or exploit anything.

This is a version-based observation: your site reports a version in the affected range. A site in that range may already be mitigated by other means (for example a web application firewall, or a backported fix), so this notice is not a statement that your site was exploitable at the time I checked.

I do not have a webmaster / I am stuck

If you are not the person who maintains the site, please forward this page to whoever does (your web developer, agency, or hosting provider). They will recognize the steps above quickly.

If you are maintaining the site yourself and get stuck, I am happy to help point you in the right direction at no cost. Reach out using the contact details below.

Contact

Evan Harris, Security Researcher

I reach out about issues like this purely to help operators secure their sites. If you would prefer not to be contacted again, just let me know and I will honor that.

References

Official advisories and tracking

Vendor / plugin