CVE-2026-57332 is a broken access control vulnerability in the Wallet System for WooCommerce plugin by WP Swings, affecting versions up to 2.7.6. The vulnerability allows subscriber-level users to perform unauthorized actions due to missing authorization checks (CWE-862). The CVSS 3.1 base score is 7.1, indicating high severity, with an attack vector over the network, low attack complexity, requiring privileges at the subscriber level, no user interaction, and impacts integrity and availability but not confidentiality. No patch or official remediation has been disclosed as of the publication date.

The vulnerability allows attackers with subscriber privileges to perform unauthorized actions that can alter data or disrupt availability within the Wallet System for WooCommerce plugin. Confidential information is not impacted. The flaw could lead to integrity and availability issues in affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for unusual activity related to wallet operations. Avoid granting unnecessary permissions to subscriber roles in the affected plugin.