TeraWallet – Wallet for WooCommerce < 1.6.10 – Subscriber+ Wallet Balance Inflation via Discounted Top-Up | CVE 2026-16538

Description

The plugin does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.

Proof of Concept

Prerequisites: TeraWallet + WooCommerce active on https://victim.example/. As a store admin, create an ordinary percentage store coupon, e.g. code "save90" = 90% off (any applicable discount coupon works). Wallet top-ups are enabled by default.

As a logged-in Customer:
1. Go to My Account > My Wallet > Wallet topup, enter a top-up amount of 100 and submit. This adds the wallet rechargeable product to the WooCommerce cart at 100.
2. Go to the cart and apply the coupon "save90". The order total drops to 10 while the line subtotal stays 100.
3. Complete checkout paying the discounted 10 (use any method that completes the order, e.g. Cash on Delivery, then have the order set to Processing/Completed so payment is registered).
4. Open My Account > My Wallet: the balance shows 100 credited, not 10.

Result: paid 10, received 100 in spendable wallet credit. Repeatable and unbounded, yielding free store credit each time.