Wallet System for WooCommerce Cross-Site Request Forgery Vulnerability
Vulnerability
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Wallet System for WooCommerce plugin, specifically in versions 2.6.2 and prior. The issue arises from inadequate nonce validation in the 'class-wallet-user-table.php' file, allowing unauthenticated attackers to manipulate wallet balances. Exploitation requires tricking a site administrator into clicking a link that initiates the forged request.
Impact
Exploitation of this vulnerability allows for unauthorized modification of wallet balances.
Remediation
Users are advised to update the Wallet System for WooCommerce plugin to version 2.6.3 or a later patched version.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.