CVE-2022-3995CWE-639

TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference

Medium · published November 29, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to lock/unlock other users wallets.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00604 · 48.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2022-11-29T20:43Z
EPSS history
Timeline
  • 29 NOV 20:43Z
    TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference
    cvelistv5