Skip to content
Noroxi

Wallet for WooCommerce

woo-wallet · plugin

Known security vulnerabilities for Wallet for WooCommerce. Find out in seconds which version runs on your site with WP Lens.

9 known vulnerabilities

2 exploitable without logging in · latest Jul 11, 2026

Listed on wordpress.org · latest 1.7.0 · last updated Sep 11, 2026 · 20K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2022-36401unauthenticated · needs a click≤ 1.3.24

    WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2026-32398login required≤ 1.5.15

    WordPress TeraWallet – For WooCommerce plugin <= 1.5.15 - Race Condition vulnerability

    Medium 6.5

  • CVE-2024-7747subscriber+≤ 1.5.6

    Wallet for WooCommerce <= 1.5.6 - Authenticated (Subscriber+) Incorrect Conversion between Numeric Types

    Medium 6.5

  • CVE-2024-6353subscriber+≤ 1.5.4

    Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'

    Medium 6.5

  • CVE-2024-32584high privilege≤ 1.5.0

    WordPress TeraWallet plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

    Medium 4.8

  • CVE-2022-40198unauthenticated · needs a click≤ 1.3.24

    WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF)

    Medium 4.3

  • CVE-2026-12103subscriber+≤ 1.6.4

    Wallet for WooCommerce <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action

    Medium 4.3

  • CVE-2024-1690subscriber+≤ 1.4.10

    TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds <= 1.4.10 - Missing Authorization to Authenticated (Subscribe

    Medium 4.3

  • CVE-2022-3995subscriber+≤ 1.4.3

    TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory