External risk intelligence

Wallet for WooCommerce Top-Up Value Flaw

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-16538

The vulnerability affects a WordPress plugin designed for e-commerce wallet functionality. As a public-facing web store feature, it is intended to be accessible to customers over the internet for processing transactions, making the exposed surface area highly likely to be internet-facing.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Wallet for WooCommerce WordPress plugin could allow customers to overvalue their wallet top-ups, potentially impacting financial transactions. The issue arises because the plugin does not adequately verify the actual amount collected before crediting a user's wallet. The main concern is confirming relevance and exposure within our e-commerce operations.

Allows underpaying for wallet credits.
Impacts financial integrity and customer trust.
Confirm plugin usage and transaction validity.

Attack Path

How an attacker could exploit the issue

An attacker can manipulate a shopping cart to fund a digital wallet with less money than the actual transaction value. This allows them to gain an inflated wallet balance without proper payment verification.

No authentication required.
Manipulate wallet top-up amount.
Acquire funds with less money.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow customers to artificially inflate their wallet balance by topping it up with less value than the credited amount. This affects the integrity of the wallet system and the financial record-keeping within the WooCommerce store.

Wallet balances and transaction records.
Customers can top up with less value.
Financial discrepancies and loss of funds.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Wallet for WooCommerce WordPress plugin's vulnerability requires immediate attention from e-commerce platform owners and potentially the development team responsible for the plugin's maintenance. The first practical step is to confirm all instances of this plugin within your WooCommerce environments, identify any that are externally accessible, and assess their business criticality before planning any remediation actions.

E-commerce platform owners should lead remediation.
Verify all plugin instances and exposure.
Plan and execute risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Wallet for WooCommerce WordPress plugin?

This plugin adds a virtual wallet system to WooCommerce stores, letting customers deposit funds to use for future purchases. It manages digital balances, transaction histories, and top-up processes within the WordPress e-commerce ecosystem.

What does CWE-284 mean for CVE-2026-16538?

CWE-284 refers to Improper Access Control. In this specific case, the plugin fails to verify that the payment collected matches the requested wallet credit amount. This lack of authorization check lets a user credit their account with more value than they actually paid.

How does an attacker trigger this vulnerability?

An attacker initiates a top-up request and manipulates the transaction process to credit their wallet without completing the full payment. This does not require an existing account or administrative privileges; it exploits the plugin's failure to validate the transaction total before updating the balance.

Do I need to worry if my store uses this plugin?

Yes, because Halo Surface Signal indicates that this plugin is typically internet-facing to support customer transactions. Since the functionality is designed for public web access, your store is likely exposed to this risk if you have not applied the fix.

How should I respond to CVE-2026-16538?

Start by identifying all WordPress sites running the Wallet for WooCommerce plugin. Once mapped, confirm your specific version and prioritize updating to version 1.6.10 or later to ensure the plugin correctly validates incoming payments before crediting wallet balances.

References

wpscan.com/vulnerability/bc87bb91-a0c4-4d35-8be1-6d3ec2623a86/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.