CVE-2024-1690

Name of the Vulnerable Software and Affected Versions The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress versions up to, and including, 1.4.10

Description The issue allows authenticated attackers with subscriber-level access and above to export a list of registered users and their emails due to a missing capability check on the terawallet export user search() function.

Recommendations For versions up to, and including, 1.4.10, update to a version that includes a fix for the missing capability check in the terawallet export user search() function to prevent unauthorized data access.