CVE-2022-3995

MEDIUM

The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on t...

Affects 1 product across 1 vendor.

CVSS 3.14.3
EPSS0.6%
Percentile48th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, no availability impact.
CWE Weakness Definitions
CWE-639: Authorization Bypass Through User-Controlled Key (IDOR)

Software uses a user-supplied key to access resources without verifying authorization for that specific resource.

◆ AI Analysis — automated analysis, not human-reviewed

The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference, allowing authenticated attackers with subscriber-level permissions and above to lock/unlock other users' wallets.

BSID: BS-2022-GLOBAL-332579-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-3995?
The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference, allowing authenticated attackers with subscriber-level permissions and above to lock/unlock other users' wallets.
What is the CVSS score for CVE-2022-3995?
CVE-2022-3995 has CVSS 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS: 0.6%.
Is CVE-2022-3995 actively exploited?
No confirmed active exploitation of CVE-2022-3995 as of 2026-09-25.
How do I remediate CVE-2022-3995?
Priority: MEDIUM.
What systems are affected by CVE-2022-3995?
CVE-2022-3995 affects Standalonetech Terawallet.
Vulnerability Details
CVE IDCVE-2022-3995
BSIDBS-2022-GLOBAL-332579-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Published2022-11-29
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
Authorization Bypass Through User-Controlled Key (IDOR)
SourceNVD
Official Description

The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to lock/unlock other users wallets.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action, enabling attackers to manipulate wallet states of other users.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Standalonetech Terawallet ≤ 1.4.3
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1416 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash0db32895bf19d3710bdfe2e56dd62b8339d3adfaacbb714fe9d6f97889b79f137d3aae0218e8fe9a784a575d6bb998b854995bc35246841db47eed4e0a364ebc
Related CVEs affecting Standalonetech
CVE-2022-36401 8.8 Cross-Site Request Forgery (CSRF) vulnerability in TeraWallet – For WooCommer... CVE-2024-6353 6.5 The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injectio... CVE-2024-7747 6.5 The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect co... CVE-2024-32584 4.8 Improper Neutralization of Input During Web Page Generation ('Cross-site Scri... CVE-2022-40198 4.3 Cross-Site Request Forgery (CSRF) vulnerability in StandaloneTech TeraWallet ...
View all Standalonetech CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →