未評価

The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC...

CVE-2026-108763 SecPulse初出 15:00

影響パッケージ

種類	パッケージ	影響を受ける版	直った版
CVE	Wallet System for WooCommerce	2.8.2 未満	2.8.2

原文の説明取得元が公開している説明をそのまま載せています (多くは英語)。

The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.

出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

参照URL

web contact@wpscan.com
web nvd.nist.gov
web wpscan.com
web github.com