AUGUST 14, 2026
Live Feed
Back to database
Case File

CVE-2026-16538

CRITICAL · CVSS 9.1 EPSS 0.23%

Source: NVD + CISA KEV + EPSS · Published 2026-08-12 · Last synced 2026-08-14

CyberRota Analysis

AI-Generated

The Wallet for WooCommerce WordPress plugin prior to version 1.6.10 is vulnerable as it fails to verify the actual amount collected during wallet top-ups, enabling customers to credit their wallets with amounts less than intended. This flaw could lead to financial losses for merchants due to unauthorized wallet balance increases. WordPress site administrators utilizing this plugin should prioritize updating to the latest version to mitigate potential exploitation.

CVE
CVE-2026-16538
Severity
CRITICAL
CVSS
9.1
EPSS
0.23%
WordPress

Original NVD Description

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.