CVE-2025-68029: 
WordPress vulnerability analysis and mitigation

CVE-2025-68029 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) in the WP Swings Wallet System for WooCommerce WordPress plugin. It affects all versions up to and including 2.7.3, and was reported by researcher Denver Jackson on September 24, 2025, with public disclosure on December 29, 2025. The CVE was formally published on January 5, 2026. It carries a CVSS v3.0 base score of 6.3 (Medium), assigned by Patchstack (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data in responses or communications sent to authenticated users who should not have access to that information. Exploitation requires a low-privileged authenticated account (Subscriber-level or above) and is conducted over the network with low attack complexity and no user interaction required. The flaw falls under OWASP Top 10 category A1: Broken Access Control, suggesting that insufficient authorization checks allow lower-privileged users to retrieve wallet-related sensitive data embedded in plugin responses (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to retrieve sensitive information that is normally restricted to higher-privileged users, such as wallet balances, transaction data, or other financial details managed by the plugin. The vulnerability has low impact on confidentiality, integrity, and availability (C:L/I:L/A:L), meaning it does not grant full system compromise but can expose data that may be leveraged to facilitate further attacks or fraud. The scope is limited to the affected WordPress installation, but in e-commerce environments, exposure of wallet or payment-related data can have significant business and compliance implications (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-68029. The EPSS score is approximately 0.037%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this type and score are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Wallet System for WooCommerce plugin (versions ≤ 2.7.3) using tools like WPScan or by inspecting plugin directories and readme files.
2. Authentication: Register or log in as a low-privileged user (e.g., Subscriber) on the target WordPress site.
3. Trigger vulnerable endpoint: Send authenticated HTTP requests to plugin endpoints or REST API routes that handle wallet data, observing responses for sensitive information embedded in the returned data.
4. Extract sensitive data: Parse the response to retrieve wallet balances, transaction histories, or other financial data that should be restricted to higher-privileged users.
5. Leverage extracted data: Use the exposed information to facilitate further attacks, such as account takeover, fraud, or targeted social engineering (Patchstack).

• Logs: WordPress access logs showing repeated authenticated GET/POST requests from a single low-privileged user account to wallet-related plugin endpoints (e.g., /wp-admin/admin-ajax.php with wallet-related action parameters).
• Logs: Unusual access patterns from subscriber-level accounts querying wallet or transaction data outside of normal business hours.
• Network: Elevated volume of authenticated API requests to WooCommerce wallet plugin endpoints from a single IP address or user account.
• Application: Multiple subscriber-level accounts created in a short timeframe, potentially indicating automated account registration for exploitation purposes.

The vendor (WP Swings) has released a patched version: update to Wallet System for WooCommerce version 2.7.4 or later to resolve the vulnerability. Site administrators unable to update immediately should consider using Patchstack's virtual patching/mitigation rule, which blocks exploitation attempts until the plugin is updated. Restricting new user registrations or subscriber-level access on affected sites can also reduce the attack surface in the interim (Patchstack).