CVE-2026-19213: Enforcement of Behavioral Workflow in WonderTrader
A vulnerability exists in WonderTrader up to version 0.9.9 in the Pending Order Handler component, specifically in the _undone_qty function. The issue involves manipulation of the getUndoneQty argument, which can enforce unintended behavioral workflow. The vulnerability can be exploited remotely. Public exploit code is available. The vendor has not responded to disclosure requests. The CVSS score is 4.3, indicating a low severity impact.
AI Analysis
Technical Summary
CVE-2026-19213 is a vulnerability in WonderTrader versions up to 0.9.9 affecting the _undone_qty function in src/WtCore/TraderAdapter.h within the Pending Order Handler component. The flaw arises from manipulation of the getUndoneQty argument, which leads to enforcement of behavioral workflow that may not be intended by the application logic. This vulnerability is remotely exploitable, and public exploit code exists. The vendor was notified but did not provide any response or patch information.
Potential Impact
The vulnerability allows an attacker with remote access and low privileges to manipulate the behavior of the Pending Order Handler component by altering the getUndoneQty argument. This can lead to integrity impacts on the workflow but does not affect confidentiality or availability. The CVSS base score of 4.3 reflects a low severity impact with no confidentiality or availability loss and limited integrity impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is publicly available, users should monitor official channels for updates. Until a fix is released, consider restricting remote access to the affected component if possible.
CVE-2026-19213: Enforcement of Behavioral Workflow in WonderTrader
Description
A vulnerability exists in WonderTrader up to version 0.9.9 in the Pending Order Handler component, specifically in the _undone_qty function. The issue involves manipulation of the getUndoneQty argument, which can enforce unintended behavioral workflow. The vulnerability can be exploited remotely. Public exploit code is available. The vendor has not responded to disclosure requests. The CVSS score is 4.3, indicating a low severity impact.
CVSS v4.0
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19213 is a vulnerability in WonderTrader versions up to 0.9.9 affecting the _undone_qty function in src/WtCore/TraderAdapter.h within the Pending Order Handler component. The flaw arises from manipulation of the getUndoneQty argument, which leads to enforcement of behavioral workflow that may not be intended by the application logic. This vulnerability is remotely exploitable, and public exploit code exists. The vendor was notified but did not provide any response or patch information.
Potential Impact
The vulnerability allows an attacker with remote access and low privileges to manipulate the behavior of the Pending Order Handler component by altering the getUndoneQty argument. This can lead to integrity impacts on the workflow but does not affect confidentiality or availability. The CVSS base score of 4.3 reflects a low severity impact with no confidentiality or availability loss and limited integrity impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is publicly available, users should monitor official channels for updates. Until a fix is released, consider restricting remote access to the affected component if possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-22gg-289x-58qq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19213"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a7742a1bf8831d539b084eb
Added to database: 08/08/2026, 14:52:17 UTC
Last enriched: 08/08/2026, 15:15:56 UTC
Last updated: 08/09/2026, 02:40:59 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.