CVE-2022-3995

Name of the Vulnerable Software and Affected Versions TeraWallet plugin for WordPress versions up to, and including, 1.4.3

Description The issue is due to insufficient validation of the user-controlled key on the "lock unlock terawallet" AJAX action. This allows authenticated attackers with subscriber-level permissions and above to lock or unlock other users' wallets.

Recommendations For versions up to, and including, 1.4.3, update to a version that fixes the insufficient validation of the user-controlled key on the "lock unlock terawallet" AJAX action to prevent unauthorized access to wallets. As a temporary workaround, consider restricting access to the "lock unlock terawallet" AJAX action to minimize the risk of exploitation.