CVE-2024-13724

MEDIUM 4.3CVE-2024-13724 · Published 04/03/2025 · updated 17/06/2026

In short

CVE-2024-13724 is a MEDIUM (CVSS 4.3) vulnerability affecting wallet system for woocommerce (wpswings).
Chance of exploitation in the next 30 days (EPSS): 0.25%, higher than 16.1% of all vulnerabilities.
Fix: update to 2.6.3 or later.

Package	Affected versions	Patched versions
wallet system for woocommerce wpswings	`< 2.6.3`	`2.6.3`

Description

The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to increase their own wallet balance, transfer balances between arbitrary users and initiate transfer requests from other users' wallets.

References

plugins.trac.wordpress.org/changeset · Patch
wordfence.com/threat-intel/vulnerabilities/id/bda326b0-9049-496a-a600-fa65151ce98f · Third Party Advisory

More vulnerabilities in wallet system for woocommerce

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free