WordPress Plugin Vulnerabilities

TeraWallet – For WooCommerce < 1.5.16 - Authenticated (Customer+) Race Condition

Description

The Wallet for WooCommerce plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 1.5.15. This makes it possible for authenticated attackers, with Custom-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
woo-wallet
Fixed in 1.5.16

References

CVE
CVE-2026-32398
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e15d7310-90b0-410e-b758-6b142c70d111

Classification

Type
RACE CONDITION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-362
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
b4shu206
Verified
No
WPVDB ID
9bc12227-387e-4a40-9c5d-f36cd25068d1

Timeline

Publicly Published
2026-02-20 (about 4 months ago)
Added
2026-05-05 (about 1 month ago)
Last Updated
2026-05-05 (about 1 month ago)

Other

Published
Title
Published
2022-11-24
Title
WP ULike < 4.6.5 - Unauthenticated Rating Tampering via Race Condition
Published
2023-11-06
Title
kk Star Ratings < 5.4.6 - Rating Tampering via Race Condition
Published
2022-10-05
Title
WP-Polls < 2.77.0 - Subscriber+ Race Condition
Published
2022-09-14
Title
Rate my Post < 3.3.5 - Subscriber+ Votes Tampering via Race Condition
Published
2025-12-15
Title
Fancy Product Designer | WooCommerce WordPress < 6.5.0 - Unauthenticated Server-Side Request Forgery via Race Condition