Is CVE-2026-57332 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57332 being exploited in the wild.

How severe is CVE-2026-57332?

High severity, with a CVSS score of 7.1, published 29 June 2026.

Which products and versions are affected?

WP Swings Wallet System for WooCommerce <= 2.7.6.

Is there a fix for CVE-2026-57332?

A patch was published on 2026-06-29: Version 2.7.7 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57332 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57332?

Check whether you run WP Swings Wallet System for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57332: WP Swings Wallet System for WooCommerce broken access control

Q: Is there a fix for CVE-2026-57332?

A patch was published on 2026-06-29: Version 2.7.7 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-57332 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57332?

Check whether you run WP Swings Wallet System for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57332 · Severity: high · CVSS 7.1 · Published 2026-06-29

A security vulnerability exists in the Wallet System for WooCommerce plugin, which allows customers to maintain a digital balance on e-commerce sites. An attacker with a basic 'Subscriber' account (typically a standard customer login) can bypass security checks to perform actions they are not authorized to do. This could lead to unauthorized modifications of wallet data or disruption of the store's payment ecosystem.

Technologies: WP Swings Wallet System for WooCommerce. Vendors: WP Swings.

Quick answers

Is CVE-2026-57332 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57332 being exploited in the wild.
How severe is CVE-2026-57332?: High severity, with a CVSS score of 7.1, published 29 June 2026.
Which products and versions are affected?: WP Swings Wallet System for WooCommerce <= 2.7.6.
Is there a fix for CVE-2026-57332?: A patch was published on 2026-06-29: Version 2.7.7 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57332 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57332?: Check whether you run WP Swings Wallet System for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Wallet System for WooCommerce plugin for WordPress is vulnerable to Broken Access Control due to missing authorization checks (CWE-862) in versions up to and including 2.7.6. An authenticated attacker with Subscriber-level permissions can exploit this flaw via network requests to execute functions that should be restricted to higher-privileged users. The vulnerability allows for unauthorized integrity changes and low-level availability impact. The issue is resolved in version 2.7.7.

Affected products

WP Swings Wallet System for WooCommerce <= 2.7.6

Timeline

2026-04-17: disclosed: Reported by Evan NR
2026-06-29: advisory: Published by Patchstack and NVD
2026-06-29: patched: Version 2.7.7 released to address the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.