CVE-2024-7747

MEDIUM

The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and including, 1.5.6. This is due to a numerical logic flaw when t...

Affects 1 product across 1 vendor.

CVSS 3.16.5
EPSS0.5%
Percentile41th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, full integrity impact, no availability impact.
CWE Weakness Definitions
CWE-681: CWE-681
◆ AI Analysis — automated analysis, not human-reviewed

The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types, allowing authenticated attackers to create and distribute funds.

BSID: BS-2024-GLOBAL-045096-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-7747?
The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types, allowing authenticated attackers to create and distribute funds.
What is the CVSS score for CVE-2024-7747?
CVE-2024-7747 has CVSS 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS: 0.5%.
Is CVE-2024-7747 actively exploited?
No confirmed active exploitation of CVE-2024-7747 as of 2026-09-25.
How do I remediate CVE-2024-7747?
Priority: HIGH.
What systems are affected by CVE-2024-7747?
CVE-2024-7747 affects Standalonetech Terawallet.
Vulnerability Details
CVE IDCVE-2024-7747
BSIDBS-2024-GLOBAL-045096-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Published2024-11-28
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-681
SourceNVD
Official Description

The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and including, 1.5.6. This is due to a numerical logic flaw when transferring funds to another user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create funds during a transfer and distribute these funds to any number of other users or their own account, rendering products free. Attackers could also request to withdraw funds if the Wallet Withdrawal extension is used and the request is approved by an administrator.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from a numerical logic flaw during the transfer of funds, enabling attackers with Subscriber-level access and above to manipulate the transfer process and create additional funds.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Standalonetech Terawallet < 1.5.7
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 686 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashfc99e87d1b1c4492e270dc30ddf85ada2f447dc2eacbcdcfc89afc894a4dbc6f0a3864e42b8552ef74926b67552791c5d0c7bc9d6296332d1f00a35fe01870f3
Related CVEs affecting Standalonetech
CVE-2022-36401 8.8 Cross-Site Request Forgery (CSRF) vulnerability in TeraWallet – For WooCommer... CVE-2024-6353 6.5 The Wallet for WooCommerce plugin for WordPress is vulnerable to SQL Injectio... CVE-2024-32584 4.8 Improper Neutralization of Input During Web Page Generation ('Cross-site Scri... CVE-2022-3995 4.3 The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object R... CVE-2022-40198 4.3 Cross-Site Request Forgery (CSRF) vulnerability in StandaloneTech TeraWallet ...
View all Standalonetech CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →