CVE-2022-36401

HIGH

Cross-Site Request Forgery (CSRF) vulnerability in TeraWallet – For WooCommerce plugin <= 1.3.24 versions.

Affects 1 product across 1 vendor.

CVSS 3.18.8
EPSS0.3%
Percentile17th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-352: Cross-Site Request Forgery (CSRF)

Web application does not verify that a request was intentionally sent by the authenticated user.

Related Attack Patterns (CAPEC)
CAPEC-462 Cross-Domain Search Timing
via CWE-352
CAPEC-467 Cross Site Identification
via CWE-352
CAPEC-62 Cross Site Request Forgery
via CWE-352
CAPEC-111 JSON Hijacking (aka JavaScript Hijacking)
via CWE-352

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A Cross-Site Request Forgery (CSRF) vulnerability exists in the TeraWallet – For WooCommerce plugin versions up to and including 1.3.24. This vulnerability could allow an attacker to perform unauthorized actions on behalf of an authenticated user.

BSID: BS-2023-GLOBAL-062151-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-36401?
A Cross-Site Request Forgery (CSRF) vulnerability exists in the TeraWallet – For WooCommerce plugin versions up to and including 1.3.24. This vulnerability could allow an attacker to perform unauthorized actions on behalf of an authenticated user.
What is the CVSS score for CVE-2022-36401?
CVE-2022-36401 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS: 0.3%.
Is CVE-2022-36401 actively exploited?
No confirmed active exploitation of CVE-2022-36401 as of 2026-05-30.
How do I remediate CVE-2022-36401?
Priority: HIGH.
What systems are affected by CVE-2022-36401?
CVE-2022-36401 affects Standalonetech Terawallet.
Vulnerability Details
CVE IDCVE-2022-36401
BSIDBS-2023-GLOBAL-062151-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published2023-02-02
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
Cross-Site Request Forgery (CSRF)
SourceNVD
Official Description

Cross-Site Request Forgery (CSRF) vulnerability in TeraWallet – For WooCommerce plugin <= 1.3.24 versions.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from the lack of proper CSRF tokens in certain forms within the plugin. An attacker could exploit this by tricking a user into visiting a malicious website while they are logged into the affected WooCommerce site, leading to unauthorized actions such as modifying settings or making transactions.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Standalonetech Terawallet < 1.4.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1351 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashe52a8c503949da7951fa8ac115941b1459ce2634b53c14246555830d985898e98085ac0aa93e80bcc3e7242538c629bcb75c6e7e3406be5c0c4334163ba7e09e
Related CVEs affecting Standalonetech
CVE-2024-6353 6.5 The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injectio... CVE-2024-7747 6.5 The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect co... CVE-2024-32584 4.8 Improper Neutralization of Input During Web Page Generation ('Cross-site Scri... CVE-2022-3995 4.3 The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object R... CVE-2022-40198 4.3 Cross-Site Request Forgery (CSRF) vulnerability in StandaloneTech TeraWallet ...
View all Standalonetech CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →