[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-YSP9MhMvBDAVrrOcCpzHRZrp9646ic-2SG2HOEMnak":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":33,"research_started_at":34,"research_completed_at":35,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":36},"CVE-2026-12103","wallet-for-woocommerce-missing-authorization-to-authenticated-subscriber-useremail-enumeration-via-terawalletexportusers","Wallet for WooCommerce \u003C= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User\u002FEmail Enumeration via terawallet_export_user_search AJAX Action","The Wallet for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the login name, email address, and user ID of all WordPress accounts — including administrators — by submitting arbitrary search terms to the AJAX handler. The required 'search-user' nonce is localized into the wallet_param object on the standard WooCommerce My Account page, which is accessible to any authenticated user, making it trivially obtainable by a Subscriber.","woo-wallet",null,"\u003C=1.6.4","1.6.5","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Missing Authorization","2026-07-10 17:34:12","2026-07-11 05:35:49",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F98b38844-c6fe-4655-8bbe-7600203b567e?source=api-prod",1,[22,23,24,25,26,27,28],"includes\u002Fclass-woo-wallet-admin.php","includes\u002Fclass-woo-wallet-ajax.php","includes\u002Fclass-woo-wallet.php","includes\u002Fhelper\u002Fwoo-wallet-util.php","languages\u002Fwoo-wallet.pot","readme.txt","woo-wallet.php","researched",false,3,"This exploitation research plan targets **CVE-2026-12103**, a missing authorization vulnerability in the **Wallet for WooCommerce (TeraWallet)** plugin. The goal is to demonstrate how an authenticated user with Subscriber-level permissions can enumerate all registered users' login names and email addresses.\n\n---\n\n### 1. Vulnerability Summary\nThe vulnerability exists in the `terawallet_export_user_search` function within `includes\u002Fclass-woo-wallet-ajax.php`. While the function performs a nonce check and a capability check, the capability check relies on `get_wallet_user_capability()`. In affected versions, this capability defaults to one held by Subscriber-level users, or the function fails to enforce administrative restrictions required for global user enumeration. Consequently, any authenticated user can query the WordPress user database via the AJAX endpoint.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Action:** `terawallet_export_user_search`\n*   **HTTP Method:** `POST`\n*   **Parameters:**\n    *   `action`: `terawallet_export_user_search` (Required)\n    *   `security`: The `search-user` nonce (Required)\n    *   `term`: The search string for enumeration (e.g., `a` or `@`)\n*   **Authentication:** Authenticated (Subscriber or higher)\n*   **Preconditions:** The attacker must obtain a valid nonce, which is localized for all authenticated users on the \"My Account\" page.\n\n### 3. Code Flow\n1.  **Entry Point:** The AJAX request triggers `wp_ajax_terawallet_export_user_search`, which calls `Woo_Wallet_Ajax::terawallet_export_user_search()`.\n2.  **Nonce Verification:** `check_ajax_referer( 'search-user', 'security' )` (Line 186) validates the transaction-specific token.\n3.  **Authorization Check:** `get_wallet_user_capability()` (Line 188) is invoked. The vulnerability stems from this function returning `true` or a low-privilege capability (like `read`) for Subscriber users.\n4.  **Data Sink:** `get_users()` (Line 195) is called with the user-provided `term` mapped to the `search` parameter with wildcards (`*term*`). It specifically searches `user_login`, `user_nicename`, and `user_email`.\n5.  **Data Exposure:** The results are looped (Lines 203-210) and returned via `wp_send_json()`, leaking the `user_login` and `user_email`.\n\n### 4. Nonce Acquisition Strategy\nThe `search-user` nonce is required to bypass the `check_ajax_referer` check. The plugin localizes this nonce into the `wallet_param` JavaScript object on pages where wallet functionality is initialized, specifically the WooCommerce \"My Account\" page.\n\n**Acquisition Steps:**\n1.  Log in as a Subscriber user.\n2.  Navigate to the `\u002Fmy-account\u002F` page.\n3.  The nonce is embedded in the HTML source within a script block.\n4.  Use the `browser_eval` tool to extract the nonce:\n    ```javascript\n    browser_eval(\"window.wallet_param?.search_user_nonce\")\n    ```\n    *(Note: Based on standard TeraWallet localization patterns, the key is expected to be `search_user_nonce` or similar within the `wallet_param` object).*\n\n### 5. Exploitation Strategy\nThe exploitation involves sending a crafted POST request to the AJAX endpoint using the obtained nonce.\n\n**Step-by-Step Plan:**\n1.  **Login:** Authenticate as a Subscriber user and capture the session cookies.\n2.  **Retrieve Nonce:** Navigate to `\u002Fmy-account\u002F` and extract the `security` token from `wallet_param`.\n3.  **Perform Enumeration:** Use the `http_request` tool to send a search query.\n    *   **URL:** `http:\u002F\u002F[target]\u002Fwp-admin\u002Fadmin-ajax.php`\n    *   **Method:** `POST`\n    *   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n    *   **Body:** `action=terawallet_export_user_search&security=[NONCE]&term=@`\n    *(Using `@` is effective for capturing all email addresses; `a` or `e` are effective for capturing common logins).*\n\n### 6. Test Data Setup\nTo verify the vulnerability, the environment should contain:\n1.  **Administrator Account:** (e.g., `admin_user \u002F admin@example.com`).\n2.  **Victim Account:** A second user to prove enumeration (e.g., `victim_user \u002F victim@example.com`).\n3.  **Attacker Account:** A Subscriber-level user (e.g., `attacker \u002F attacker@example.com`).\n4.  **Plugin Config:** Default \"Wallet for WooCommerce\" installation.\n5.  **Page Setup:** Ensure the WooCommerce \"My Account\" page is published and accessible to the `attacker` user.\n\n### 7. Expected Results\nA successful exploit will return a `200 OK` status with a JSON array. Each element in the array will contain:\n*   `label`: A string formatted as `Username (email@example.com)`.\n*   `value`: The integer User ID.\n\n**Example Response:**\n```json\n[\n  {\"label\": \"admin (admin@example.com)\", \"value\": 1},\n  {\"label\": \"victim_user (victim@example.com)\", \"value\": 2},\n  {\"label\": \"attacker (attacker@example.com)\", \"value\": 3}\n]\n```\n\n### 8. Verification Steps\nAfter the exploit, verify the accuracy of the leaked data using WP-CLI:\n1.  **List Users:** Run `wp user list --fields=ID,user_login,user_email` and compare the output to the JSON returned by the exploit.\n2.  **Confirm Capability:** Check the return value of the capability helper for a Subscriber:\n    ```bash\n    wp eval \"wp_set_current_user( [ATTACKER_ID] ); echo get_wallet_user_capability();\"\n    ```\n\n### 9. Alternative Approaches\nIf `wallet_param` is not found on the My Account page:\n*   **Shortcode Discovery:** Scan the source code for `add_shortcode` (e.g., `[terawallet_dashboard]`).\n*   **Page Creation:** Create a private page with the discovered shortcode:\n    ```bash\n    wp post create --post_type=page --post_status=publish --post_content='[terawallet_dashboard]' --post_author=[ATTACKER_ID]\n    ```\n*   **Re-attempt Extraction:** Navigate to the new page and attempt to extract `wallet_param` again, as the shortcode often triggers the script and nonce localization.","gemini-3-flash-preview","2026-07-15 08:16:46","2026-07-15 08:17:43",{"type":37,"vulnerable_version":38,"fixed_version":11,"vulnerable_browse":39,"vulnerable_zip":40,"fixed_browse":41,"fixed_zip":42,"all_tags":43},"plugin","1.6.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwoo-wallet\u002Ftags\u002F1.6.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwoo-wallet.1.6.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwoo-wallet\u002Ftags\u002F1.6.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwoo-wallet.1.6.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwoo-wallet\u002Ftags"]