Wallet System for WooCommerce < 2.7.10 – Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount | CVE 2026-15045

Description

The plugin does not validate a user-supplied wallet amount against the customer's actual stored balance during checkout, allowing authenticated customers to arbitrarily reduce their own order total, including down to zero, and complete checkout without paying the merchant.

Proof of Concept

Preconditions: WooCommerce active + Wallet System for WooCommerce < 2.7.10 active; the wallet system enabled (WP Swings > Wallet > General Settings > Enable Wallet System); a purchasable product; attacker = a Customer account whose real wallet balance is 0.

1. Log in as the Customer. Add a product (e.g. a $100 product) to the cart.

2. Open any front-end page and read the nonce from the page source, emitted as:
   var wsfw_public_param = { ... "nonce":"<NONCE>" ... }
   (present on every front-end page while the wallet system is enabled).

3. Send the partial-payment AJAX from the Customer session, claiming a wallet_amount
   equal to the cart total even though the real balance is 0:

   POST /wp-admin/admin-ajax.php
   Cookie: <customer session cookies>
   Content-Type: application/x-www-form-urlencoded

   action=calculate_amount_total_after_wallet&nonce=<NONCE>&checked=true&wallet_amount=100

   Response: {"status":true,"message":"Wallet amount used successfully: "}

4. Return to checkout and place the order. The cart now shows a "Via wallet" fee of
   -$100, the payable total is $0, and the order completes charging the gateway $0.
   The Customer's real wallet balance is never debited.

A second handler is equivalent:
   action=calculate_amount_after_wallet&nonce=<NONCE>&checked=true&wallet_amount=100&amount=100