Junglewise Threat Intelligence

CVE-2026-12103: subratamal Wallet for WooCommerce authorization bypass in AJAX handler

CVE-2026-12103 · Severity: medium · CVSS 4.3 · Published 2026-07-11

Executive brief

The Wallet for WooCommerce plugin for WordPress, which adds digital wallet functionality to online stores, contains a security flaw that allows registered users to view sensitive account details of other users. By exploiting this issue, any logged-in customer could discover the login names, email addresses, and user IDs of all other accounts on the site, including those of administrators. This information could be used to facilitate more targeted attacks or unauthorized access attempts against the store's staff and customers.

Technical details

The Wallet for WooCommerce plugin suffers from a missing authorization check (CWE-862) in its AJAX handler. The vulnerability exists because the plugin fails to verify if a user has sufficient permissions before executing a user search action. While the action requires a 'search-user' nonce, this nonce is localized into the 'wallet_param' object on the standard WooCommerce 'My Account' page, making it accessible to any authenticated user. An attacker with Subscriber-level privileges can obtain this nonce and submit arbitrary search terms to the AJAX handler to enumerate the login names, email addresses, and user IDs of all WordPress accounts, including administrators. The issue is present in all versions up to and including 1.6.4.

Affected products

  • subratamal Wallet for WooCommerce up to, and including, 1.6.4

Timeline

  • 2026-07-11: advisory
  • 2026-07-11: disclosed

References