CVE- 2026 – 94244: Missing Consent in Purse System for WooCommerce

On 02/ 09/ 2026, a protection scientist at Astra Safety and security discovered a Missing out on Permission susceptability in Pocketbook System for WooCommerce , a popular WordPress plugin by WP Swings that adds wallet-based settlements to WooCommerce stores.

The root cause is a Missing out on Authorization susceptability (CWE- 862 leading to Sensitive Info Disclosure through Exported Data (CWE- 200 in the plugin’s administrative wallet-transaction export attribute. The function itself is a legitimate bookkeeping tool, allowing store managers export every customer’s wallet-transaction background as a PDF or CSV file. The issue is who’s allowed to cause it.

In its current form, any confirmed individual with Subscriber-level gain access to or higher can upload a nonce sourced from an unrelated function to any / wp-admin/ *. php URL and receive back a complete data source dump of every customer’s purse transactions and PII. On a WooCommerce store, this includes every Customer-tier account.

The defect sits in the export handler’s registration and permission logic within admin/class-wallet-system- for-woocommerce-admin. php , particularly in wps_wsfw_download_pdf_file_callback()

Technical Malfunction of CVE- 2026 – 94244

CVE- 2026 – 94244 was found throughout a hands-on safety and security evaluation of the plugin’s management export capability and global hook registrations. The vulnerability is a book mix of 2 WordPress-specific mistakes worsened in one feature.

The export handler is signed up on WordPress’s worldwide init hook and gated by nothing more than an is_admin() wrapper , which checks just whether the demand URL falls under / wp-admin/ , not whether the requester holds any kind of actual approval to be there.

The trainer itself performs no login check and no ability check. Its solitary genuine gateway is a wp_verify_nonce() call invoked without any action disagreement, which WordPress quietly defaults to the catch-all common nonce action, meaning any kind of default-action nonce currently minted anywhere else on the website for the very same logged-in individual will certainly please it.

Exactly how was CVE- 2026 – 94244 uncovered?

While assessing the plugin’s admin hook registrations in includes/class-wallet-system- for-woocommerce. php , our researcher discovered the export function hooked straight onto WordPress’s global init action, without capability check and only a generic nonce as a gateway:

  php

$ this- > loader- > add_action(.

' init',.

$ wsfw_plugin_admin,.

' wps_wsfw_download_pdf_file_callback'.

);  

Drawing the trainer itself (admin/class-wallet-system- for-woocommerce-admin. php) , the researcher found a single wp_verify_nonce() call standing in between any kind of authenticated customer and a store-wide data source export:

  php.

public feature wps_wsfw_download_pdf_file_callback() {

$ nonce = (isset( $_ ARTICLE ['updatenoncewallet_pdf_dwnload'] ).

? sanitize_text_field( wp_unslash( $_ MESSAGE ['updatenoncewallet_pdf_dwnload'] ).

: ";.

if (wp_verify_nonce( $nonce)) {

/ / ^-- THE ENTIRE GATE. No login check. No capacity check. Default action (-1

if (isset( $_ BLOG POST ['wps_wsfw_export_pdf']) {

global $wpdb;.

$ purchases = $wpdb- > get_results(.

' PICK * FROM '. $wpdb- > prefix. 'wps_wsfw_wallet_transaction ORDER BY Id DESC'.

);.

/ / ^-- every row, every user, no WHERE provision.

}.

}

}  

Two things stood apart right away. Initially, the SQL inquiry lugged no WHERE user_id = ... provision , so the export unloaded the whole deals table regardless of that requested it. Second, with the nonce check defaulting to the common activity, any type of nonce the assailant could obtain WordPress to mint for their own session would unlock the export.

To verify the susceptability was exploitable from a low-privileged account, the researcher logged in as an ordinary Consumer and filled the plugin’s very own front-end “My Account → Purse” web page. That web page unconditionally makes a 2nd hidden type area lugging a bare default-action nonce for an entirely unrelated attribute:

  php.

/ >
 

Taking that nonce and repeating it against/ wp-admin/admin. php with wps_wsfw_export_pdf= 1 returned a real PDF including one more user’s seeded pocketbook purchases. This validated the Missing Authorization susceptability (CWE- 862, causing the accountable disclosure and this advisory.

Exactly how to replicate the susceptability CVE- 2026 – 94244

Prerequisites

• A running instance of Purse System for WooCommerce < 2 8.0 installed on WordPress 6 9 4 + WooCommerce 11.0. 1 (versions used by the scientist).
• 2 WooCommerce Consumer accounts:” sufferer (with seeded purse transactions) and “opponent” (without partnership to target and no wallet-management opportunities).
• Network accessibility to the WordPress website.

Steps

1. Seed the “sufferer” Client account with budget transaction history. In the scientist’s test, 2 transactions were utilized: a $ 250 PayPal Budget Recharge and a $ 40 Order Settlement, both connected to [email protected]
2. Visit to the WordPress website as the “enemy” Consumer account and verify the assailant can not fill the plugin’s admin pocketbook dashboard straight (as anticipated, considered that dashboard’s own manage_options gate).
3. From the aggressor’s session, load the front-end “My Account → Pocketbook” web page and extract the worth of the concealed wps_verifynonce field. This nonce is minted utilizing wp_create_nonce() without activity debate, providing the opponent a valid default-action nonce for their very own session.
4. Article that nonce to any/ wp-admin/ *. php URL (e.g.,/ wp-admin/admin. php), along with wps_wsfw_export_pdf= 1, making use of the aggressor’s validated session cookies:

  http.

ARTICLE/ wp-admin/admin. php HTTP/ 1 1
Cookie: 
Content-Type: application/x-www-form- urlencoded.

updatenoncewallet_pdf_dwnload=  & wps_wsfw_export_pdf= 1    

5. The server responds with HTTP 200 OK, Content-Type: application/pdf , and Content-Disposition: attachment; filename=" transaction.pdf
6. Unwinding and checking the returned PDF’s web content stream validates it has the target’s genuine deal background, consisting of the $ 40 Order Settlement and $ 250 PayPal Pocketbook Recharge rows, correctly attributed to [email protected] :

 -- decompressed PDF web content stream (passage)--.

sufferer| [email protected] |Customer|$ 40 00|Order Repayment|Budget.

victim| [email protected] |Client|$ 250 00|Wallet Recharge|PayPal  

Alternate payload (CSV export): Replace wps_wsfw_export_pdf= 1 with wps_wsfw_export_csv= 1 to get the exact same information as a CSV file as opposed to a PDF.

Impact of CVE- 2026 – 94244

Any kind of verified Subscriber-tier (or greater) account can acquire a full, store-wide export of every client’s wallet deal history and personally identifiable details in a single request. The vulnerability could cause:

• Full export of every client’s PII throughout the whole shop (name, e-mail address, duty)
• Complete export of every customer’s monetary purchase history (quantities, repayment techniques, purchase types, IDs, dates)
• Violation of monetary privacy obligations under GDPR , PCI DSS , and similar regimens
• Secondary targeting of individual high-value consumers making use of the exfiltrated data
• Reconnaissance for follow-on assaults versus the vendor’s wider customer base
• Potential development to unauthenticated exploitation on implementations where a default-action nonce is reachable by guest site visitors

Existing Condition of CVE- 2026 – 94244

The problem was responsibly revealed to WP Swings through a collaborated disclosure channel and has actually been patched in variation 2 8.0. The susceptability was openly catalogued by WPScan on 2026 – 10 – 06 (WPVDB ID 991 f 28 f 3 – 9 cd 8 – 4918 – 8431 -a 063 eb 2 bachelor’s degree 536, with the technological PoC embargoed up until 2026 – 10 – 20 to give website owners time to upgrade.

This searching for is clearly differentiated from CVE- 2026 – 57332, a prior weak-nonce problem in the same plugin patched in variations 2 7 9 and 2 7 10 That earlier repair was scoped to wp_ajax _ *- registered AJAX trainers in a different file. The susceptible function explained in this advisory is hooked on init in admin/class-wallet-system- for-woocommerce-admin. php and was not covered by that setting pass. It was covered separately in 2 8.0.

What Can You Do?

Customers need to upgrade Purse System for WooCommerce to version 2 8.0 or later promptly. If an immediate upgrade is not feasible, execute the adhering to workarounds:

• Add an ability check (e.g., current_user_can( 'manage_woocommerce' or current_user_can( 'manage_options') before the nonce sign in wps_wsfw_download_pdf_file_callback(), matching the pattern the vendor already makes use of properly in other places in the plugin (e.g., wps_wsfw_current_user_can_manage_wallet()
• Change the common wp_verify_nonce( $nonce) phone call with a feature-specific activity string (e.g., wp_verify_nonce( $nonce, 'wps_wsfw_export_transactions' )), so the nonce can never be satisfied by an unassociated attribute’s token.
• As a defense-in-depth procedure, audit all other init-registered handlers in the plugin for the exact same is_admin() -just entrance pattern.
• Evaluation web server gain access to logs for message demands to / wp-admin/ *. php Links bring wps_wsfw_export_pdf or wps_wsfw_export_csv criteria from low-privileged individual sessions.

Astra Safety and security helps you test for this vulnerability and comparable missing-authorization flaws throughout a manual pentest.