CVE-2024-13682

MEDIO 4.3CVE-2024-13682 · Published 04/03/2025 · updated 17/06/2026

In breve

CVE-2024-13682 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda wallet system for woocommerce (wpswings).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.15%, superiore al 4.1% delle vulnerabilità.
Correzione: aggiornare a 2.6.3 o successiva.

Package	Affected versions	Patched versions
wallet system for woocommerce wpswings	`< 2.6.3`	`2.6.3`

Description

The Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.2. This is due to missing or incorrect nonce validation in class-wallet-user-table.php. This makes it possible for unauthenticated attackers to modify wallet balances via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

References

plugins.trac.wordpress.org/changeset · Patch
wordfence.com/threat-intel/vulnerabilities/id/779a9f7a-4582-4d5e-bd9a-9ff7f14b452a · Third Party Advisory

Altre vulnerabilità di wallet system for woocommerce

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free