Description
The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to lock/unlock other users wallets.
References (3)
Core 3
Core References
Patch, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2817824/woo-wallet/trunk?contextall=1&old=2816610&old_path=%2Fwoo-wallet%2Ftrunk
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3995
Scores
CVSS v3
4.3
EPSS
0.0013
EPSS Percentile
32.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-639
Status
published
Products (2)
standalonetech/terawallet
< 1.4.3
subratamal/Wallet for WooCommerce
< 1.4.3
Published
Nov 29, 2022
Tracked Since
Feb 18, 2026