CVE-2025-14450
📋 TL;DR
The Wallet System for WooCommerce WordPress plugin has an authorization vulnerability that allows authenticated users with Subscriber-level access or higher to manipulate wallet withdrawal requests. Attackers can arbitrarily increase their own wallet balance or decrease other users' balances. This affects all WordPress sites using the plugin up to version 2.7.2.
💻 Affected Systems
- Wallet System for WooCommerce WordPress plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could drain all user wallets, create unlimited funds for themselves, and cause financial loss to both users and site owners through fraudulent transactions.
Likely Case
Attackers will increase their own wallet balances to make fraudulent purchases or withdraw funds, potentially causing direct financial loss to the site owner.
If Mitigated
With proper access controls and monitoring, unauthorized transactions can be detected and reversed before significant damage occurs.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. The vulnerability is publicly documented with code references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.3 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Wallet System for WooCommerce'. 4. Click 'Update Now' if available. 5. Alternatively, download version 2.7.3+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the Wallet System for WooCommerce plugin until patched
wp plugin deactivate wallet-system-for-woocommerce
Restrict user registration
allDisable new user registration to prevent attackers from creating accounts
wp option update users_can_register 0
🧯 If You Can't Patch
- Implement strict access controls to limit who can access wallet management functions
- Enable detailed logging of all wallet transactions and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin under Plugins → Installed Plugins. If version is 2.7.2 or lower, you are vulnerable.Check Version:
wp plugin get wallet-system-for-woocommerce --field=versionVerify Fix Applied:
After updating, verify the plugin version shows 2.7.3 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Unusual wallet balance changes
- Multiple withdrawal request status changes from single user
- Wallet balance increases without corresponding deposits
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=change_wallet_fund_request_status
SIEM Query:
source="wordpress.log" AND "change_wallet_fund_request_status" AND user_role="subscriber"🔗 References
- https://plugins.trac.wordpress.org/browser/wallet-system-for-woocommerce/tags/2.7.2/includes/class-wallet-system-ajaxhandler.php#L140
- https://plugins.trac.wordpress.org/browser/wallet-system-for-woocommerce/trunk/includes/class-wallet-system-ajaxhandler.php#L140
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3435898%40wallet-system-for-woocommerce&new=3435898%40wallet-system-for-woocommerce&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/466a5315-fc05-4b96-9dfd-17862fc406c5?source=cve
