CVE-2025-14450 - Wallet System for WooCommerce <= 2.7.2 - missing authorization to authenticated ...

CVE ID : CVE-2025-14450 Published : Jan. 17, 2026, 3:16 a.m. | 1 hour, 9 minutes ago Description : The Wallet System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'change_wallet_fund_request_status_callback' function in all versions up to, and including, 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to manipulate wallet withdrawal requests and arbitrarily increase their wallet balance or decrease other users' balances. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...