Wallet for WooCommerce <= 1.5.6 - Authenticated (Subscriber+) Incorrect Conversion between Numeric Types
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and including, 1.5.6. This is due to a numerical logic flaw when transferring funds to another user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create funds during a transfer and distribute these funds to any number of other users or their own account, rendering products free. Attackers could also request to withdraw funds if the Wallet Withdrawal extension is used and the request is approved by an administrator.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| subratamal | Wallet for WooCommerce | up to 1.5.6 | — | No fix listed | CNA |
- Wallet for WooCommerce Vendorsubratamal Affected up to 1.5.6 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:standalonetech:terawallet:*:*:*:*:*:wordpress:*:* | before 1.5.7 | Vulnerable | subratamal |
- cpe:2.3:a:standalonetech:terawallet:*:*:*:*:*:wordpress:*:* Versions before 1.5.7 Vulnerable ·subratamal
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-7747
- 2026-10-03 Alias added: GHSA-78pw-6g8h-cp3c
References
More subratamal Terawallet vulnerabilities
- TI-2024-05895 Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]' CVSS 3.1HIGH 8.8
- TI-2022-16738 WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
- TI-2024-21471 WordPress TeraWallet plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 5.9
- TI-2022-03664 TeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference CVSS 3.1MEDIUM 4.3
- TI-2024-01571 Missing authorization in subratamal Wallet for WooCommerce CVSS 3.1MEDIUM 4.3
- TI-2022-19064 WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1MEDIUM 4.3
Sources
- CVE-2024-7747 · CVE Program
- CVE-2024-7747 · NVD
- FIRST EPSS
- GHSA-78pw-6g8h-cp3c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences