{"id":"CVE-2026-108763","kind":"vulnerability","aliases":["CVE-2026-108763"],"related":[],"title":"WordPress Wallet System plugin lets low-privilege users overwrite others' KYC records","description":"The Wallet System for WooCommerce  WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.","summary":"The Wallet System for WooCommerce WordPress plugin before 2.8.2 accepts a user ID from the request for KYC document submission without checking ownership. An authenticated Subscriber or Customer can overwrite the KYC documents and verification status of any other user, including administrators.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kyc","runtime","self-hosted","woocommerce","wordpress"],"not_affected_if":["no-public-registration","plugin-not-installed","plugin-version-2.8.2-or-later"],"how_to_check":"- Check the installed version of the Wallet System for WooCommerce plugin in the WordPress admin Plugins list; versions before `2.8.2` are affected.\n- Confirm whether the site has the plugin active and whether customers or subscribers can register accounts.","fix":"- Wallet System for WooCommerce: move to `2.8.2` or later.","status":"open","published_at":"2026-10-29T06:17:17+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","triaged_at":"2026-10-29T06:54:55+00:00","updated_at":"2026-10-29T06:54:55+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-29T06:54:55Z","model":"claude-haiku-5-5","output":{"fix":"- Wallet System for WooCommerce: move to `2.8.2` or later.","reach":"internet","title":"WordPress Wallet System plugin lets low-privilege users overwrite others' KYC records","impact":"medium","summary":"The Wallet System for WooCommerce WordPress plugin before 2.8.2 accepts a user ID from the request for KYC document submission without checking ownership. An authenticated Subscriber or Customer can overwrite the KYC documents and verification status of any other user, including administrators.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","woocommerce","kyc","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"any logged-in low-privilege user overwrites administrator KYC records","analyst_note":"","how_to_check":"- Check the installed version of the Wallet System for WooCommerce plugin in the WordPress admin Plugins list; versions before `2.8.2` are affected.\n- Confirm whether the site has the plugin active and whether customers or subscribers can register accounts.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-version-2.8.2-or-later","no-public-registration"],"who_is_affected":"Sites running the Wallet System for WooCommerce plugin before 2.8.2 that let users register accounts with the Subscriber or Customer role. Sites without this plugin, or where no account can be created by outsiders, are less exposed. The unknown is how many sites allow open registration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000706,"input_tokens":4150,"output_tokens":581,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-108763':16A,19A '-2026':15A,18A '2.8.2':35B,77C 'accept':36B 'account':92C 'administr':68B,136C 'allow':111C 'authent':51B,112C 'capabl':109C 'check':48B,110C 'client':101C 'client-suppli':100C 'current':88C 'custom':54B,121C 'cve':14A,17A 'document':45B,59B,83C,126C 'field':104C 'handler':85C 'host':24B 'id':39B,97C 'includ':67B,134C 'kyc':12A,20B,44B,58B,82C,125C 'let':5A 'low':7A 'low-privileg':6A 'minim':115C 'other':11A 'overwrit':10A,56B,123C 'ownership':49B,107C 'plugin':4A,33B,75C 'privileg':8A,116C 'record':13A 'request':42B,103C 'restrict':80C 'runtim':21B 'self':23B 'self-host':22B 'status':62B,129C 'submiss':46B,84C 'subscrib':52B,119C 'suppli':102C 'system':3A,29B,71C 'take':93C 'target':95C 'user':9A,38B,66B,89C,96C,113C,133C 'verif':61B,128C 'wallet':2A,28B,70C 'without':47B 'woocommerc':25B,31B,73C 'wordpress':1A,26B,32B,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Wallet System for WooCommerce plugin before 2.8.2 that let users register accounts with the Subscriber or Customer role. Sites without this plugin, or where no account can be created by outsiders, are less exposed. The unknown is how many sites allow open registration.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T06:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108763","severity":null,"published_at":"2026-10-29T06:17:17+00:00","modified_at":"2026-10-29T06:17:17+00:00","first_seen_at":"2026-10-29T06:53:13+00:00","fetched_at":"2026-10-29T06:53:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}