CVE-2026-42654

HighCVSS 7.1/10Last modified Jul 22, 2026

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Swings Wallet System for WooCommerce allows Password Recovery Exploitation.

This issue affects Wallet System for WooCommerce: from n/a through 2.7.5.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published
Jun 2, 2026
Last modified
Jul 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-426555.9Unauthenticated Bypass Vulnerability in Best Payments Plugin for WP <= 4.6.19 versions.CVE-2026-426566.5Subscriber Cross Site Scripting (XSS) in Contest Gallery <= 28.1.6 versions.CVE-2026-426575.3Unauthenticated Other Vulnerability Type in Contest Gallery <= 28.1.7 versions.CVE-2026-426587.1Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.3.8 versions.CVE-2026-426596.5Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.CVE-2026-42666.7An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to the local filesysteCVE-2026-426606.5Subscriber Sensitive Data Exposure in Contest Gallery <= 28.1.7 versions.CVE-2026-426618.8Custom role Path Traversal in WP Customer Area <= 8.3.4 versions.CVE-2026-426626.5Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions.CVE-2026-426636.5Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions.CVE-2026-426648.2Unauthenticated Broken Access Control in AI Product Search for WooCommerce &#8211; Motive Commerce Search <= 1.38.2 versions.CVE-2026-426659.3Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions.