CVE-2026-16538 PUBLISHED

TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up

Assigner: WPScan
Reserved: 22.07.2026 Published: 12.08.2026 Updated: 12.08.2026

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.

Product Status

Vendor Unknown
Product Wallet for WooCommerce
Versions Default: unaffected
  • affected from 0 to 1.6.10 (excl.)

Credits

  • Guillermo Álvarez Fernández finder
  • WPScan coordinator

References

Problem Types

  • CWE-284 Improper Access Control CWE