CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the terawallet_export_user_search() function in all versions up to, and including, 1.4.10. This makes it possible for authenticated attackers, with subscriber-level access and above, to export a list of registered users and their emails.
Explanation of Vulnerability in Simple Terms
Wallet for WooCommerce versions up to 1.4.10 lack proper authorization checks, allowing authenticated users to access sensitive wallet data they should not see. An attacker with a low-privilege account can read other users' wallet information without additional interaction. This affects confidentiality but not data integrity or availability.
What an attacker can do
Read other users' wallet data and transaction history.
Potential impact on your site
Customer wallet data and transaction history may be exposed to other authenticated users.
Conditions required to exploit
Attacker must have a valid low-privilege WooCommerce account (e.g., customer).
Key dates
External resources
Related vulnerabilities
