CVE-2026-12103— WordPress Wallet for WooCommerce 授权问题漏洞

Wallet for WooCommerce <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) User/Email Enumeration via terawallet_export_user_search AJAX Action

The Wallet for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the login name, email address, and user ID of all WordPress accounts — including administrators — by submitting arbitrary search terms to the AJAX handler. The required 'search-user' nonce is localized into the wallet_param object on the standard WooCommerce My Account page, which is accessible to any authenticated user, making it trivially obtainable by a Subscriber.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

授权机制缺失

WordPress Wallet for WooCommerce 授权问题漏洞

WordPress Wallet for WooCommerce是WordPress基金会的一款WooCommerce电子钱包插件。 WordPress Wallet for WooCommerce 1.6.4及之前版本存在授权问题漏洞，该漏洞源于未正确验证用户是否有权执行操作，可能导致经过身份验证的攻击者通过提交任意搜索词到AJAX处理程序，枚举所有WordPress账户的登录名、电子邮件地址和用户ID。

N/A

N/A