CVE-2026-94244

MediumCVSS 4.3/10Last modified Oct 8, 2026

Description

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user, such as a subscriber, to disclose all users' names, email addresses, roles, transaction amounts, payment methods and dates.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Oct 8, 2026
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-942456.5The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet CVE-2026-942466.3The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission beCVE-2026-94258.8A security vulnerability has been detected in Edimax EW-7438RPn 1.31. The impacted element is the function formWlanMP of the file /goform/foCVE-2026-942508.2Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller cCVE-2026-942516.5A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue afCVE-2026-942545.3The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, aCVE-2026-942568.1The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs CVE-2026-942578.1The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actuallyCVE-2026-942582.7The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before retCVE-2026-94268.8A vulnerability was detected in Edimax EW-7438RPn 1.31. This affects the function formHwSet of the file /goform/formHwSet. The manipulation CVE-2026-942605.3The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a CVE-2026-942615.3The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, n