Live › vulnerability › CVE-2026-108763
The Wallet System for WooCommerce WordPress plugin before 2.8.2 accepts a user ID from the request for KYC document submission without checking ownership. An authenticated Subscriber or Customer can overwrite the KYC documents and verification status of any other user, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the Wallet System for WooCommerce plugin before 2.8.2 that let users register accounts with the Subscriber or Customer role. Sites without this plugin, or where no account can be created by outsiders, are less exposed. The unknown is how many sites allow open registration.
No product ranges from the sources yet.
2.8.2 are affected.2.8.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-108763")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.