Is CVE-2026-93509 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-93509?

CVE-2026-93509 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-93509

Description

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.