---
id: "CVE-2026-108763"
kind: "vulnerability"
aliases: ["CVE-2026-108763"]
title: "WordPress Wallet System plugin lets low-privilege users overwrite others' KYC records"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["kyc", "runtime", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["no-public-registration", "plugin-not-installed", "plugin-version-2.8.2-or-later"]
published_at: "2026-10-29T06:17:17+00:00"
first_seen_at: "2026-10-29T06:53:13+00:00"
updated_at: "2026-10-29T06:54:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108763", "first_seen_at": "2026-10-29T06:53:13+00:00"}]
---

# WordPress Wallet System plugin lets low-privilege users overwrite others' KYC records

The Wallet System for WooCommerce WordPress plugin before 2.8.2 accepts a user ID from the request for KYC document submission without checking ownership. An authenticated Subscriber or Customer can overwrite the KYC documents and verification status of any other user, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Wallet System for WooCommerce plugin in the WordPress admin Plugins list; versions before `2.8.2` are affected.
- Confirm whether the site has the plugin active and whether customers or subscribers can register accounts.

## Fix

- Wallet System for WooCommerce: move to `2.8.2` or later.

## Timeline

- 2026-10-29T06:53:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108763

## From the sources

The Wallet System for WooCommerce  WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_