CVE-2026-12103 is an authorization bypass vulnerability (CWE-862) in the Wallet for WooCommerce plugin for WordPress, affecting all versions up to and including 1.6.4. The plugin fails to properly verify that a user is authorized to perform user enumeration actions via an AJAX handler. Authenticated users with subscriber-level privileges can submit arbitrary search terms to enumerate login names, email addresses, and user IDs of all WordPress accounts, including administrators. The 'search-user' nonce required for this action is exposed on the WooCommerce My Account page, accessible to any authenticated user, facilitating trivial exploitation. No official patch or remediation level has been published as of the data provided.

An authenticated attacker with subscriber-level access can enumerate sensitive user information such as login names, email addresses, and user IDs for all WordPress accounts on the site, including administrators. This information disclosure could aid in further targeted attacks or social engineering. There is no impact on data integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to user enumeration. Avoid exposing the 'search-user' nonce to unauthorized users if feasible through custom code or configuration.