| |
Vulnerability CVE-2022-3995
Published: 2022-11-29
| Description: |
The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to lock/unlock other users wallets. |
References: |
https://plugins.trac.wordpress.org/changeset/2817824/woo-wallet/trunk?contextall=1&old=2816610&old_path=%2Fwoo-wallet%2Ftrunk
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3995
|
|
|
Copyright 2026, cxsecurity.com
|
|
|
