# CVE-2026-42654: WP Swings Wallet System for WooCommerce authentication bypass in password recovery

Source: https://junglewise.ai/threats/cve-2026-42654-wp-swings-wallet-system-for-woocommerce-authentication-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-42654 · Severity: high · CVSS 7.1 · Published 2026-06-02

A security vulnerability in the Wallet System for WooCommerce plugin allows unauthorized users to bypass standard security checks during the password recovery process. This plugin is used to manage digital wallets and customer credits on e-commerce sites. An attacker could exploit this flaw to gain access to other user accounts, potentially leading to the theft of digital funds or full administrative takeover of the online store.

Technologies: [WP Swings Wallet System for WooCommerce](https://junglewise.ai/threats/technologies/wallet-system-for-woocommerce). Vendors: [WP Swings](https://junglewise.ai/threats/vendors/wp-swings).

## Quick answers

**Is CVE-2026-42654 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42654 being exploited in the wild.

**How severe is CVE-2026-42654?** High severity, with a CVSS score of 7.1, published 2 June 2026.

**Which products and versions are affected?** WP Swings Wallet System for WooCommerce <= 2.7.5.

**Is there a fix for CVE-2026-42654?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42654 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42654?** Check whether you run WP Swings Wallet System for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Wallet System for WooCommerce plugin (versions 2.7.5 and earlier) is vulnerable to an authentication bypass via an alternate path or channel (CWE-288). The flaw resides in the password recovery logic, which fails to properly validate the identity of the requester through standard authentication channels. An attacker with low-level (Subscriber) privileges can exploit this to manipulate the password reset process and gain access to higher-privileged accounts. This vulnerability is exploitable over the network without user interaction. A fix is available in version 2.7.6.

## Affected products

- WP Swings Wallet System for WooCommerce <= 2.7.5

## Timeline

- 2026-03-16: other: Reported by Jakub Herman
- 2026-04-29: advisory: Patchstack advisory published
- 2026-06-02: disclosed: NVD publication date

## References

- [https://patchstack.com/database/wordpress/plugin/wallet-system-for-woocommerce/vulnerability/wordpress-wallet-system-for-woocommerce-plugin-2-7-5-broken-authentication-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wallet-system-for-woocommerce/vulnerability/wordpress-wallet-system-for-woocommerce-plugin-2-7-5-broken-authentication-vulnerability?_s_id=cve)

## Related threats

- [WooCommerce Points and Rewards IDOR in wallet and points update](https://junglewise.ai/threats/cve-2026-11782-woocommerce-points-and-rewards-idor-in-wallet-and-points-update)
- [WP Swings Wallet System for WooCommerce broken access control](https://junglewise.ai/threats/cve-2026-57332-wp-swings-wallet-system-for-woocommerce-broken-access-control)