CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Subrata Mal TeraWallet – For WooCommerce woo-wallet allows Leveraging Race Conditions.This issue affects TeraWallet – For WooCommerce: from n/a through <= 1.5.15.
Explanation of Vulnerability in Simple Terms
TeraWallet for WooCommerce versions up to 1.5.15 contain a race condition that allows authenticated users to modify data they should not have access to. An attacker with a low-privilege account can exploit timing windows during concurrent requests to alter sensitive information. The vulnerability does not affect confidentiality or availability, but integrity is compromised.
What an attacker can do
Modify data or settings they should not have permission to change by exploiting race conditions in concurrent requests.
Potential impact on your site
Authenticated users can alter sensitive WooCommerce or payment data through timing attacks, risking transaction integrity and financial records.
Conditions required to exploit
Attacker must have a low-privilege WooCommerce user account; no user interaction required.
Key dates
External resources
Related vulnerabilities
