CVE-2026-42654: WordPress Wallet System for WooCommerce plugin <= 2.7.5 - Broken Authentication vulnerability

Synopsis

Broken authentication vulnerability in the Wallet System for WooCommerce WordPress plugin (versions up to and including 2.7.5) allows a remote attacker with a low-privilege account to exploit an alternate password recovery path or channel to bypass normal authentication controls. The attack is reachable over the network and requires no victim interaction. Successful exploitation gives the attacker high integrity impact, meaning they can modify wallet balances, transaction records, or account settings beyond their authorized scope, while also gaining limited read access to sensitive data. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as the upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the WordPress installation via standard HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege account (such as a standard WooCommerce customer account) is sufficient to reach the vulnerable password recovery code path.

• Victim interactionNot required

  No victim action is needed; the attacker drives the exploit entirely from their own session.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Attacker can hijack or reset account credentials for other users by abusing the alternate password recovery channel, effectively taking over targeted accounts.
• Attacker can modify wallet balances or transaction records within WooCommerce, enabling fraudulent credits or unauthorized fund transfers.
• Attacker gains limited read access to account data exposed during the authentication bypass flow, such as registered email addresses or order references.
• Availability is not impacted; the service remains operational while the attacker operates covertly.