TeraWallet WooCommerce Plugin Wallet Balance Inflation via Discounted Top-Up (CVE-2026-16538)

Vulnerability Overview Vulnerability Name: TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up Description: The plugin fails to verify the actual amount received before crediting the user's wallet, allowing users to top up their wallets with an amount lower than the actual value. CVE ID: CVE-2026-16538 Classification: - Type: ACCESS CONTROLS - OWASP Top 10: A5: Broken Access Control - CWE: CWE-284 - CVSS: 6.5 (medium) Affected Versions Affected Plugin: woo-wallet Fixed Version: 1.6.10 Remediation Fixed Version: Upgrade to version 1.6.10 or later. Timeline Public Disclosure Date: 2026-08-10 Added Date: 2026-08-10 Last Updated: 2026-08-10 Additional Information Original Researcher: Guillermo Álvarez Fernández Submitter: Guillermo Álvarez Fernández Verification Status: Yes WPVDB ID: bc87bb91-a0c4-4d35-8be1-6d3ec2623a86 References CVE: CVE-2026-16538 Other Related Vulnerabilities Leads-5050 Visitor Insights < 1.0.4 - Unauthenticated License Change Rencontre – Dating Site < 3.11 - Privilege Escalation Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce < 1.2.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation Custom Product Tabs for WooCommerce < 1.7.8 - Unauthenticated Toggle Content Setting Update Simple 301 Redirects by BetterLinks - 2.0.0 - 2.0.3 - Update and Retrieve Wildcard Value Proof of Concept (PoC) PoC Code: No specific PoC code is provided on the page, but it mentions that the PoC will be demonstrated on August 24, 2026, to give users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

TeraWallet WooCommerce Plugin Wallet Balance Inflation via Discounted Top-Up (CVE-2026-16538)

More from this source