CVE-2026-94244

Name of the Vulnerable Software and Affected Versions The Wallet System for WooCommerce versions prior to 2.8.0

Description The plugin fails to perform necessary capability checks and relies on a token that any authenticated user can obtain from a front-end page. This flaw allows an authenticated user, such as a subscriber, to generate a report that discloses sensitive information for all customers, including names, email addresses, roles, transaction amounts, payment methods, and dates.

Recommendations Update to version 2.8.0 or later.