The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress suffers from a missing capability check in the terawallet_export_user_search() function. This missing authorization allows any authenticated user with subscriber-level privileges or above to export a list of registered users and their email addresses. The vulnerability is classified as CWE-862 (Missing Authorization) and affects all versions up to 1.4.10. The CVSS v3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges, no user interaction, and impacts confidentiality only.

An attacker with subscriber-level access or higher can export a list of registered users and their email addresses, leading to unauthorized disclosure of user data. This compromises user privacy but does not affect integrity or availability of the system. The impact is limited to information disclosure of user emails.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access to trusted users only and monitor for unusual export activity. Avoid granting unnecessary privileges to users. Follow updates from the plugin vendor or WordPress security advisories for any forthcoming patches.