CVE-2024-32446 MEDIUM

CVE-2024-32446: WordPress Wallet System for WooCommerce plugin <= 2.5.9 - Cross Site Request Forgery (CSRF) vulnerability

Vendor Wp Swings
Product Wallet System for WooCommerce
Weakness CWE-352 · CSRF
Published April 15, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in WP Swings Wallet System for WooCommerce.This issue affects Wallet System for WooCommerce: from n/a through 2.5.9.

Explanation of Vulnerability in Simple Terms

02Summary

The Wallet System for WooCommerce plugin contains a cross-site request forgery (CSRF) vulnerability affecting versions up to 2.5.9. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the wallet system without the admin's knowledge or consent. This could result in unauthorized modifications to wallet settings or data.

What an attacker can do

03Attacker Capabilities

Trick a logged-in admin into performing unwanted wallet system actions via a malicious webpage.

Potential impact on your site

04Site Impact

Wallet settings or data could be modified without your knowledge if an admin visits a malicious link.

Conditions required to exploit

05Prerequisites

Admin must visit attacker-controlled page while logged into WordPress.

Key dates

06Disclosure timeline

April 15, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-9723 Google Plus One Bottom <= 0.0.2 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page CVE-2026-6455 WP Contact Form 7 DB Handler <= 3.0 - Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter CVE-2026-9730 Remove NoFollow Commenter URL <= 1.0 - Cross-Site Request Forgery to Settings Update CVE-2026-49043 WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-8943 GoStats for WordPress <= 1.4 - Cross-Site Request Forgery via gostats_manage() Function