# CVE-2026-57332: WP Swings Wallet System for WooCommerce broken access control

Source: https://junglewise.ai/threats/cve-2026-57332-wp-swings-wallet-system-for-woocommerce-broken-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-57332 · Severity: high · CVSS 7.1 · Published 2026-06-29

A security vulnerability exists in the Wallet System for WooCommerce plugin, which allows customers to maintain a digital balance on e-commerce sites. An attacker with a basic 'Subscriber' account (typically a standard customer login) can bypass security checks to perform actions they are not authorized to do. This could lead to unauthorized modifications of wallet data or disruption of the store's payment ecosystem.

Technologies: [WP Swings Wallet System for WooCommerce](https://junglewise.ai/threats/technologies/wallet-system-for-woocommerce). Vendors: [WP Swings](https://junglewise.ai/threats/vendors/wp-swings).

## Quick answers

**Is CVE-2026-57332 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57332 being exploited in the wild.

**How severe is CVE-2026-57332?** High severity, with a CVSS score of 7.1, published 29 June 2026.

**Which products and versions are affected?** WP Swings Wallet System for WooCommerce <= 2.7.6.

**Is there a fix for CVE-2026-57332?** A patch was published on 2026-06-29: Version 2.7.7 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57332 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57332?** Check whether you run WP Swings Wallet System for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Wallet System for WooCommerce plugin for WordPress is vulnerable to Broken Access Control due to missing authorization checks (CWE-862) in versions up to and including 2.7.6. An authenticated attacker with Subscriber-level permissions can exploit this flaw via network requests to execute functions that should be restricted to higher-privileged users. The vulnerability allows for unauthorized integrity changes and low-level availability impact. The issue is resolved in version 2.7.7.

## Affected products

- WP Swings Wallet System for WooCommerce <= 2.7.6

## Timeline

- 2026-04-17: disclosed: Reported by Evan NR
- 2026-06-29: advisory: Published by Patchstack and NVD
- 2026-06-29: patched: Version 2.7.7 released to address the issue

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wallet-system-for-woocommerce/vulnerability/wordpress-wallet-system-for-woocommerce-plugin-2-7-6-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wallet-system-for-woocommerce/vulnerability/wordpress-wallet-system-for-woocommerce-plugin-2-7-6-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [WooCommerce Points and Rewards IDOR in wallet and points update](https://junglewise.ai/threats/cve-2026-11782-woocommerce-points-and-rewards-idor-in-wallet-and-points-update)
- [WP Swings Wallet System for WooCommerce authentication bypass in password recovery](https://junglewise.ai/threats/cve-2026-42654-wp-swings-wallet-system-for-woocommerce-authentication-bypass-in)