CVE-2022-3995

The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to lock/unlock other users wallets.

Score

CVSS 3.1 4.3 Medium

Status

Modified - security@wordfence.com

Published

2022-11-29

Last modified

2026-04-08

Weaknesses

CWE-639

Affected products

• Terawallet (Standalonetech)
• Wallet For Woocommerce (Subratamal)

References

• https://plugins.trac.wordpress.org/changeset/2817824/woo-wallet/trunk?contextall=1&old=2816610&old_path=%2Fwoo-wallet%2…
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ec57e0b2-61b0-4b67-9784-dbb4e6c4e4a6?source=cve
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3995