CVE-2022-3995

The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to lock/unlock other users wallets.

• CWE-639
• CWE-639

• https://plugins.trac.wordpress.org/changeset/2817824/woo-wallet/trunk?contextall=1&old=2816610&old_path=%2Fwoo-wallet%2FtrunkPatch, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ec57e0b2-61b0-4b67-9784-dbb4e6c4e4a6?source=cve
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3995Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2817824/woo-wallet/trunk?contextall=1&old=2816610&old_path=%2Fwoo-wallet%2FtrunkPatch, Third Party Advisory
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3995Third Party Advisory

Published

Nov 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39944In Apache Linkis <=1.2.0 when used with the MySQL Connector/…8.8
• CVE-2022-39945An improper access control vulnerability [CWE-284] in FortiM…6.5
• CVE-2022-39946An access control vulnerability [CWE-284] in FortiNAC versio…7.2
• CVE-2022-39947A improper neutralization of special elements used in an os …8.8
• CVE-2022-39948An improper certificate validation vulnerability [CWE-295] i…7.4
• CVE-2022-39949An improper control of a resource through its lifetime vulne…5.5
• CVE-2022-39950An improper neutralization of input during web page generati…5.4
• CVE-2022-39951A improper neutralization of special elements used in an os …8.8
• CVE-2022-39952A external control of file name or path in Fortinet FortiNAC…9.8
• CVE-2022-39953A improper privilege management in Fortinet FortiNAC version…7.8
• CVE-2022-39954An improper restriction of xml external entity reference in …9.1
• CVE-2022-39955The OWASP ModSecurity Core Rule Set (CRS) is affected by a p…9.8