WordPress Plugin Vulnerabilities

Wallet System for WooCommerce < 2.7.4 - Authenticated (Subscriber+) Information Exposure

Description

The Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

Affects Plugins

Plugin icon
wallet-system-for-woocommerce
Fixed in 2.7.4

References

CVE
CVE-2025-68029
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/33800fbb-7660-4704-a978-d5b64ff9f66e

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Denver Jackson
Verified
No
WPVDB ID
a87a3815-d9fc-4c51-9070-2fdf4e510e85

Timeline

Publicly Published
2025-12-29 (about 6 months ago)
Added
2026-01-14 (about 6 months ago)
Last Updated
2026-03-06 (about 4 months ago)

Other

Published
Title
Published
2025-11-06
Title
EventPrime < 4.2.5.0 - Authenticated (Subscriber+) Information Exposure
Published
2024-03-20
Title
Avada < 7.11.7 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing
Published
2025-02-28
Title
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss < 2.7.0 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Published
2026-05-08
Title
Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity < 3.3.7 - Unauthenticated Information Disclosure via REST API
Published
2026-01-21
Title
B Accordion < 2.0.3 - Contributor+ Information Exposure