CVE-2022-40198

CVE-2022-40198 analysis (TeraWallet – For WooCommerce) Affected software: StandaloneTech TeraWallet – For WooCommerce plugin <= 1.3.24 (WordPress/WooCommerce ecosystem). Root cause/tech detail: Cross-Site Request Forgery (CSRF) vulnerability in the plugin that can lead to changes in plugin set...

PT-2023-13767 · Standalonetech · Standalonetech Terawallet

Name of the Vulnerable Software and Affected Versions: StandaloneTech TeraWallet – For WooCommerce plugin versions = 1.3.24 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which can lead to changes in the plugin settings. Recommendations: For versions = 1.3.24, update t...

WordPress plugin TeraWallet–For WooCommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF)

Software TeraWallet – For WooCommerce Type Plugin Vulnerable versions = 1.3.24 Fixed in 1.4.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-40198 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 35694eeb3788 Credits...

CVE-2022-36401

Cross-Site Request Forgery CSRF vulnerability in TeraWallet – For WooCommerce plugin = 1.3.24 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in TeraWallet – For WooCommerce plugin = 1.3.24 versions...

CVE-2022-36401 WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in TeraWallet – For WooCommerce plugin = 1.3.24 versions...

CVE-2022-36401

The CVE-2022-36401 entry concerns a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin TeraWallet – For WooCommerce, affecting versions =1.4.0. Public references across CVE/NVD and vendor advisories corroborate the CSRF nature and affected version range. No exploitation detai...

CVE-2022-36401 WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in TeraWallet – For WooCommerce plugin = 1.3.24 versions...

PT-2023-13489 · WordPress · Terawallet – For Woocommerce

Name of the Vulnerable Software and Affected Versions: TeraWallet – For WooCommerce plugin versions 1.3.24 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

WordPress TeraWallet plugin insecure direct object reference vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An insecure direct object...

CVE-2022-3995

The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lockunlockterawallet AJAX action. This makes it possible for authenticated attackers, with...

Input validation

The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lockunlockterawallet AJAX action. This makes it possible for authenticated attackers, with...

CVE-2022-3995 TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference

The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lockunlockterawallet AJAX action. This makes it possible for authenticated attackers, with...

CVE-2022-3995 TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference

The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lockunlockterawallet AJAX action. This makes it possible for authenticated attackers, with...

CVE-2022-3995

The CVE-2022-3995 entry concerns the WordPress TeraWallet plugin with insecure direct object reference (IDOR) in versions up to 1.4.3. Root cause: insufficient validation of the user-controlled key in the lock_unlock_terawallet AJAX action, enabling authenticated users with subscriber-level permi...

WordPress plugin TeraWallet 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An insecure direct object...

PT-2022-25141 · WordPress · Terawallet

Name of the Vulnerable Software and Affected Versions: TeraWallet plugin for WordPress versions up to, and including, 1.4.3 Description: The issue is due to insufficient validation of the user-controlled key on the "lock unlock terawallet" AJAX action. This allows authenticated attackers with...

WordPress TeraWallet – For WooCommerce plugin <= 1.4.3 - Insecure Direct Object Reference (IDOR) vulnerability

Insecure Direct Object Reference IDOR vulnerability discovered by Marco Wotschka in the WordPress TeraWallet – For WooCommerce plugin versions = 1.4.3. Solution Update the WordPress TeraWallet – For WooCommerce plugin to the latest available version at least 1.4.4...

TeraWallet - For WooCommerce < 1.4.4 - Subscriber+ Arbitrary Wallet Lock/Unlock via IDOR

The plugin does not ensure that the wallet to lock/unlock belongs to the user making the request, allowing any authenticated users, such as subscriber to lock/unlock arbitrary wallets via an IDOR attack...