CVE-2026-15045
Medium · 6.5CVSS
6.5
EPSS
—
Published
Aug 12, 2026
CISA due date
—
The record
The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-84762 Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions. CWE-472
- CVE-2026-77999 Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to… CWE-472
- CVE-2026-84654 In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in… CWE-472
- CVE-2026-77794 The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied… CWE-472
- CVE-2026-67363 Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms <… CWE-472
- CVE-2026-16620 The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce… CWE-472
- CVE-2026-16067 The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not… CWE-472
- CVE-2026-15149 The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities… CWE-472