CVE-2026-108763

The record

The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.

Affected packages

Related vulnerabilities

• CVE-2026-63401 Coop is an open source review and moderation tool from ROOST. CWE-639
• CVE-2026-63338 IXP Manager is a full-stack web application for managing Internet Exchange Points. CWE-639
• CVE-2026-62277 LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage… CWE-639
• CVE-2026-62991 Shopper is a Headless e-commerce Admin Panel. CWE-639
• CVE-2026-119329 Immich is a high-performance self-hosted photo and video management solution. CWE-639
• CVE-2026-116239 In server mode pgAdmin 4 keeps an account per authentication source, so the same username… CWE-639
• CVE-2026-120007 NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows… CWE-639
• CVE-2026-107868 Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0… CWE-639