The Wallet for WooCommerce plugin suffers from a numeric logic flaw (CWE-681) in its fund transfer functionality, affecting all versions up to 1.5.6. This incorrect conversion between numeric types allows authenticated users with low-level privileges to inflate wallet balances by creating funds during transfers. The vulnerability can be exploited to distribute these funds across multiple accounts or to the attacker's own account. Additionally, if the Wallet Withdrawal extension is installed and withdrawal requests are approved by an administrator, attackers can cash out these unauthorized funds. The CVSS 3.1 base score is 6.5, reflecting medium severity with network attack vector, low attack complexity, and privileges required at the Subscriber level.

The vulnerability allows authenticated users with Subscriber-level or higher privileges to create and distribute unauthorized funds within the Wallet for WooCommerce plugin, effectively enabling financial fraud by making products free or allowing withdrawal of illegitimate funds if the Wallet Withdrawal extension is used and withdrawal requests are approved. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting Subscriber-level access or higher to trusted users only and carefully review withdrawal requests if the Wallet Withdrawal extension is in use. Monitoring for unusual fund transfers and limiting plugin usage may reduce risk.