Executive brief
TeraWallet is a WordPress plugin that adds a wallet payment feature to WooCommerce storefronts, allowing customers to load credit for purchases. The plugin fails to verify that customers actually paid the full amount before crediting their wallet, enabling attackers to apply large discounts at checkout and receive full wallet credit despite paying a fraction of the promised amount. This results in free store credit and direct revenue loss.
Technical details
The vulnerability is a broken access control / authorization bypass (CWE-284) in the wallet top-up flow. When a customer initiates a wallet top-up, the plugin adds a wallet product to the cart but does not validate the actual payment amount collected against the intended top-up value before crediting the wallet balance. An authenticated customer can apply any available WooCommerce coupon (including deeply discounted ones) to reduce the order total at checkout, then complete payment on the discounted amount. The plugin credits the full original top-up amount to the wallet regardless of what was actually paid. This is repeatable without limitation. The vulnerability requires authentication (customer account) and WooCommerce with coupons enabled, but no special privileges. Fixed in version 1.6.10.
Affected products
- TeraWallet Wallet for WooCommerce before 1.6.10
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Fixed in version 1.6.10
- 2026-08-12: advisory